blob: 66034c5703aee0b15909f8cd61b556e5e10e778f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
|
From 99ba5c353373ed198f54af66fe4e355ebb96e363 Mon Sep 17 00:00:00 2001
From: LEPILLER Julien <julien@lepiller.eu>
Date: Thu, 3 Aug 2017 17:04:17 +0200
Subject: [PATCH] Fix #399: Buffer over-read into uninitialized memory.
The stack allocated color map buffers were not zeroed before usage, and
so undefined palette indexes could cause information leakage.
This is CVE-2017-7890.
---
src/gd_gif_in.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/src/gd_gif_in.c b/src/gd_gif_in.c
index 008d1ec..c195448 100644
--- a/src/gd_gif_in.c
+++ b/src/gd_gif_in.c
@@ -216,6 +216,9 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromGifCtx(gdIOCtxPtr fd)
gdImagePtr im = 0;
+ memset(ColorMap, 0, 3 * MAXCOLORMAPSIZE);
+ memset(localColorMap, 0, 3 * MAXCOLORMAPSIZE);
+
if(!ReadOK(fd, buf, 6)) {
return 0;
}
--
2.13.3
|