Comment 11 for bug 210718

Tomas Hoger writes:
Value of code_size is read from GIF image, but not properly validated
before use to initialize table array in gif_read_lzw(). clear_code
used as upper bound in for loop is short, hence overflow is limited to
~16k - 4k short int values. Moreover, attacker has limited control
over the values written past the end of the buffer.