gif: ensure we have enough buffer

The block size field in the graphic control extension block should always
have the value 4, but don't trust it.

1 files changed, 1 insertions, 1 deletions

diff --git a/src/gif.c b/src/gif.c
index 054fffee..61407982 100644
--- a/src/gif.c
+++ b/src/gif.c
@@ -312,7 +312,7 @@ static inline size_t
    size_t Size = Buf[0] + 2;
    uint_t Flags;
 
-   if (Size > BSize)
+   if (BSize < 6 || Size > BSize)
       return 0;
    Buf++;
    Flags = Buf[0];