Description: security fix
  Fix CVE-2016-8888 and CVE-2016-9085
Author: Jeff Breidenbach <jab@debian.org>

---
The information above should follow the Patch Tagging Guidelines, please
checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here
are templates for supplementary fields that you might want to add:

Origin: <vendor|upstream|other>, <url of original patch>
Bug: <url in upstream bugtracker>
Bug-Debian: http://bugs.debian.org/<bugnumber>
Bug-Ubuntu: https://launchpad.net/bugs/<bugnumber>
Forwarded: <no|not-needed|url proving that it has been forwarded>
Reviewed-By: <name and email of someone who approved the patch>
Last-Update: <YYYY-MM-DD>

--- libwebp-0.5.1.orig/examples/gifdec.c
+++ libwebp-0.5.1/examples/gifdec.c
@@ -81,20 +81,27 @@ int GIFReadGraphicsExtension(const GifBy
   return 1;
 }
 
-static void Remap(const GifFileType* const gif, const uint8_t* const src,
-                  int len, int transparent_index, uint32_t* dst) {
+static int Remap(const GifFileType* const gif, const uint8_t* const src,
+                 int len, int transparent_index, uint32_t* dst) {
   int i;
   const GifColorType* colors;
   const ColorMapObject* const cmap =
       gif->Image.ColorMap ? gif->Image.ColorMap : gif->SColorMap;
-  if (cmap == NULL) return;
+  if (cmap == NULL) return 1;
+  if (cmap->Colors == NULL || cmap->ColorCount <= 0) return 0;
   colors = cmap->Colors;
 
   for (i = 0; i < len; ++i) {
-    const GifColorType c = colors[src[i]];
-    dst[i] = (src[i] == transparent_index) ? GIF_TRANSPARENT_COLOR
-           : c.Blue | (c.Green << 8) | (c.Red << 16) | (0xff << 24);
+    if (src[i] == transparent_index) {
+      dst[i] = GIF_TRANSPARENT_COLOR;
+    } else if (src[i] < cmap->ColorCount) {
+      const GifColorType c = colors[src[i]];
+      dst[i] = c.Blue | (c.Green << 8) | (c.Red << 16) | (0xffu << 24);
+    } else {
+      return 0;
+    }
   }
+  return 1;
 }
 
 int GIFReadFrame(GifFileType* const gif, int transparent_index,
@@ -139,7 +146,7 @@ int GIFReadFrame(GifFileType* const gif,
       const size_t jump = interlace_jumps[pass] * stride;
       for (; y < rect.height; y += interlace_jumps[pass], row += jump) {
         if (DGifGetLine(gif, tmp, rect.width) == GIF_ERROR) goto End;
-        Remap(gif, tmp, rect.width, transparent_index, row);
+        if (!Remap(gif, tmp, rect.width, transparent_index, row)) goto End;
       }
     }
   } else {  // Non-interlaced image.
@@ -147,7 +154,7 @@ int GIFReadFrame(GifFileType* const gif,
     uint32_t* ptr = dst;
     for (y = 0; y < rect.height; ++y, ptr += sub_image.argb_stride) {
       if (DGifGetLine(gif, tmp, rect.width) == GIF_ERROR) goto End;
-      Remap(gif, tmp, rect.width, transparent_index, ptr);
+      if (!Remap(gif, tmp, rect.width, transparent_index, ptr)) goto End;
     }
   }
   ok = 1;
