Bug 235298 - gif with invalid end-of-stream marker wasn't being

identified as corrupt.  r=paper, sr=darin

modules/libpr0n/decoders/gif/GIF2.cpp

@@ -344,8 +344,12 @@ static int do_lzw(gif_struct *gs, const PRUint8 *q)
       }
 
       /* Check for explicit end-of-stream code */
-      if (code == (clear_code + 1))
+      if (code == (clear_code + 1)) {
+        /* end-of-stream should only appear after all image data */
+        if (rows_remaining != 0)
+          return -1;
         return 0;
+      }
 
       if (oldcode == -1) {
         *rowp++ = suffix[code];

modules/libpr0n/decoders/gif/nsGIFDecoder2.cpp

@@ -332,8 +332,12 @@ int nsGIFDecoder2::EndImageFrame(
     decoder->mImageFrame->SetTimeout(aDelayTimeout);
   }
   decoder->mImageContainer->EndFrameDecode(aFrameNumber, aDelayTimeout);
-    
-  if (decoder->mObserver && decoder->mImageFrame) {
+
+  // if the gif is corrupt don't mark the frame as complete, as nsCSSRendering
+  // will happily try using it to draw a background
+  if (decoder->mObserver && 
+      decoder->mImageFrame && 
+      decoder->mGIFStruct->state != gif_error) {
     decoder->FlushImageData();
 
     if (aFrameNumber == 1) {