oss-sec mailing list archives
CVE request: GIF loader buffer overflow when initializing decompression tables
From: Thomas Biege <thomas () suse de>
Date: Tue, 2 Aug 2011 17:34:28 +0200
Hi folks, this one might need a CVE-ID... https://bugzilla.redhat.com/show_bug.cgi?id=727081 Tomas Hoger 2011-08-01 05:48:32 EDT GDK's GIF image reader is based on David Koblas' code that is also used in several other GIF image readers. This code contained an input validation flaw. Input code size was read from input GIF file and used to initialize decoding tables without checking the value, leading to buffer overflow. Relevant GDK code is: 941 static int 942 gif_prepare_lzw (GifContext *context) 943 { ... 946 if (!gif_read (context, &(context->lzw_set_code_size), 1)) { 947 /*g_message (_("GIF: EOF / read error on image data\n"));*/ 948 return -1; 949 } ... 952 context->lzw_clear_code = 1 << context->lzw_set_code_size; ... 962 for (i = 0; i < context->lzw_clear_code; ++i) { 963 context->lzw_table[0][i] = 0; 964 context->lzw_table[1][i] = i; 965 } The same flaw was previously reported for several other components that include GIF reading code based on David Koblas' parser, such as: gd (CVE-2006-4484), SDL_image (CVE-2007-6697), tk (CVE-2008-0553), netbpm (CVE-2008-0554), cups (CVE-2008-1373). This problem was corrected upstream long ago: http://git.gnome.org/browse/gdk-pixbuf/commit/gdk-pixbuf/io-gif.c?id=3bac204e0d0241a0d68586ece7099e6acf0e9bea The fix can be found in all gdk-pixbuf versions embedded in gtk2 packages, but it seems it never got it to stand-alone gdk-pixbuf version for gtk+ 1.x. Gimp corrected this bug ~2 years after GDK: http://git.gnome.org/browse/gimp/commit/plug-ins/common/gifload.c?id=cac290d093d0c318bbe33a4ff290c2abbd9698d3
Current thread:
- CVE request: GIF loader buffer overflow when initializing decompression tables Thomas Biege (Aug 02)
- Re: CVE request: GIF loader buffer overflow when initializing decompression tables Tomas Hoger (Aug 03)
- Re: CVE request: GIF loader buffer overflow when initializing decompression tables Tomas Hoger (Aug 19)