http://www.cups.org/str.php?L3914

svn diff -c 9865 http://svn.easysw.com/public/cups/
https://bugzilla.redhat.com/show_bug.cgi?id=727800#c8

--- filter/image-gif.c	2011-06-20 20:37:51.000000000 +0000
+++ filter/image-gif.c.oden	2011-10-10 08:50:17.000000000 +0000
@@ -648,11 +648,13 @@ gif_read_lzw(FILE *fp,			/* I - File to
 
     if (code == max_code)
     {
-      *sp++ = firstcode;
-      code  = oldcode;
+      if (sp < (stack + 8192))
+	*sp++ = firstcode;
+
+      code = oldcode;
     }
 
-    while (code >= clear_code)
+    while (code >= clear_code && sp < (stack + 8192))
     {
       *sp++ = table[1][code];
       if (code == table[0][code])
@@ -661,8 +663,10 @@ gif_read_lzw(FILE *fp,			/* I - File to
       code = table[0][code];
     }
 
-    *sp++ = firstcode = table[1][code];
-    code  = max_code;
+    if (sp < (stack + 8192))
+      *sp++ = firstcode = table[1][code];
+
+    code = max_code;
 
     if (code < 4096)
     {