Description: security fix
  Fix CVE-2016-8888 and CVE-2016-9085
Author: Jeff Breidenbach <jab@debian.org>

---
The information above should follow the Patch Tagging Guidelines, please
checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here
are templates for supplementary fields that you might want to add:

Origin: <vendor|upstream|other>, <url of original patch>
Bug: <url in upstream bugtracker>
Bug-Debian: http://bugs.debian.org/<bugnumber>
Bug-Ubuntu: https://launchpad.net/bugs/<bugnumber>
Forwarded: <no|not-needed|url proving that it has been forwarded>
Reviewed-By: <name and email of someone who approved the patch>
Last-Update: <YYYY-MM-DD>

--- libwebp-0.5.1.orig/examples/gifdec.c
+++ libwebp-0.5.1/examples/gifdec.c
@@ -20,7 +20,6 @@
 
 #include "webp/encode.h"
 #include "webp/mux_types.h"
-#include "webp/format_constants.h"
 
 #define GIF_TRANSPARENT_COLOR 0x00ffffff
 #define GIF_WHITE_COLOR       0xffffffff
@@ -111,8 +110,7 @@ int GIFReadFrame(GifFileType* const gif,
   int ok = 0;
   *gif_rect = rect;
 
-  if (memory_needed != (size_t)memory_needed ||
-      memory_needed > 4 * MAX_IMAGE_AREA) {
+  if (memory_needed != (size_t)memory_needed || memory_needed > (4ULL << 32)) {
     fprintf(stderr, "Image is too large (%d x %d).", rect.width, rect.height);
     return 0;
   }
@@ -135,12 +133,13 @@ int GIFReadFrame(GifFileType* const gif,
     const int interlace_jumps[]   = { 8, 8, 4, 2 };
     int pass;
     for (pass = 0; pass < 4; ++pass) {
-      int y;
-      for (y = interlace_offsets[pass]; y < rect.height;
-           y += interlace_jumps[pass]) {
+      const size_t stride = (size_t)sub_image.argb_stride;
+      int y = interlace_offsets[pass];
+      uint32_t* row = dst + y * stride;
+      const size_t jump = interlace_jumps[pass] * stride;
+      for (; y < rect.height; y += interlace_jumps[pass], row += jump) {
         if (DGifGetLine(gif, tmp, rect.width) == GIF_ERROR) goto End;
-        Remap(gif, tmp, rect.width, transparent_index,
-              dst + y * (size_t)sub_image.argb_stride);
+        Remap(gif, tmp, rect.width, transparent_index, row);
       }
     }
   } else {  // Non-interlaced image.
