diff -up cups-1.4.8/filter/image-gif.c.CVE-2011-2896 cups-1.4.8/filter/image-gif.c

--- cups-1.4.8/filter/image-gif.c.CVE-2011-2896	2011-06-20 21:37:51.000000000 +0100

+++ cups-1.4.8/filter/image-gif.c	2011-08-19 11:33:37.547911212 +0100

@@ -648,11 +648,13 @@ gif_read_lzw(FILE *fp,			/* I - File to 

     if (code == max_code)

     {

-      *sp++ = firstcode;

-      code  = oldcode;

+      if (sp < (stack + 8192))

+	*sp++ = firstcode;

+

+      code = oldcode;

     }

-    while (code >= clear_code)

+    while (code >= clear_code && sp < (stack + 8192))

     {

       *sp++ = table[1][code];

       if (code == table[0][code])

@@ -661,8 +663,10 @@ gif_read_lzw(FILE *fp,			/* I - File to 

       code = table[0][code];

     }

-    *sp++ = firstcode = table[1][code];

-    code  = max_code;

+    if (sp < (stack + 8192))

+      *sp++ = firstcode = table[1][code];

+

+    code = max_code;

     if (code < 4096)

     {