Bug 1290785 (CVE-2015-7555)

A heap-based buffer overflow vulnerability was found in giffix utility of giflib when processing records of the type `IMAGE_DESC_RECORD_TYPE' due to the allocated size of `LineBuffer' equaling the value of the logical screen width, `GifFileIn->SWidth', while subsequently having `GifFileIn->Image.Width' bytes of data written to it.

Vulnerable code:

giflib-5.1.1/util/giffix.c #35..194:
| int main(int argc, char **argv)
| {
| [...]
| if ((LineBuffer = (GifRowType) malloc(GifFileIn->SWidth)) == NULL)
| GIF_EXIT("Failed to allocate memory required, aborted.");
|
| /* Scan the content of the GIF file and load the image(s) in: */
| do {
| [...]
| switch (RecordType) {
| case IMAGE_DESC_RECORD_TYPE:
| if (DGifGetImageDesc(GifFileIn) == GIF_ERROR)
| QuitGifError(GifFileIn, GifFileOut);
| [...]
| Width = GifFileIn->Image.Width;
| Height = GifFileIn->Image.Height;
| [...]
| /* Find the darkest color in color map to use as a filler. */
| ColorMap = (GifFileIn->Image.ColorMap ? GifFileIn->Image.ColorMap :
| GifFileIn->SColorMap);
| for (i = 0; i < ColorMap->ColorCount; i++) {
| j = ((int) ColorMap->Colors[i].Red) * 30 +
| ((int) ColorMap->Colors[i].Green) * 59 +
| ((int) ColorMap->Colors[i].Blue) * 11;
| if (j < ColorIntens) {
| ColorIntens = j;
| DarkestColor = i;
| }
| }
|
| /* Load the image, and dump it. */
| for (i = 0; i < Height; i++) {
| GifQprintf("\b\b\b\b%-4d", i);
| if (DGifGetLine(GifFileIn, LineBuffer, Width)
| == GIF_ERROR) break;
| if (EGifPutLine(GifFileOut, LineBuffer, Width)
| == GIF_ERROR) QuitGifError(GifFileIn, GifFileOut);
| }
|
| if (i < Height) {
| [...]
| /* Fill in with the darkest color in color map. */
| for (j = 0; j < Width; j++)
| LineBuffer[j] = DarkestColor;
| for (; i < Height; i++)
| if (EGifPutLine(GifFileOut, LineBuffer, Width)
| == GIF_ERROR) QuitGifError(GifFileIn, GifFileOut);
| }
| break;
| [...]
| }
| }
| while (RecordType != TERMINATE_RECORD_TYPE);
| [..]
| }