This service will be undergoing maintenance at 00:00 UTC, 2017-10-23 It is expected to last about 30 minutes
Bug 1290785 - (CVE-2015-7555) CVE-2015-7555 giflib: Heap-based buffer overflow in giffix utility
CVE-2015-7555 giflib: Heap-based buffer overflow in giffix utility
Status: CLOSED WONTFIX
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20151221,repor...
: Security
Depends On: 1293371 1293372
Blocks: 1290786
  Show dependency treegraph
 
Reported: 2015-12-11 08:02 EST by Adam Mariš
Modified: 2016-04-27 01:51 EDT (History)
19 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-12-23 12:54:59 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Adam Mariš 2015-12-11 08:02:20 EST
A heap-based buffer overflow vulnerability was found in giffix utility of giflib when processing records of the type `IMAGE_DESC_RECORD_TYPE' due to the allocated size of `LineBuffer' equaling the value of the logical screen width, `GifFileIn->SWidth', while subsequently having `GifFileIn->Image.Width' bytes of data written to it.

Vulnerable code:

giflib-5.1.1/util/giffix.c #35..194:
| int main(int argc, char **argv)
| {
| [...]
| if ((LineBuffer = (GifRowType) malloc(GifFileIn->SWidth)) == NULL)
| GIF_EXIT("Failed to allocate memory required, aborted.");
|
| /* Scan the content of the GIF file and load the image(s) in: */
| do {
| [...]
| switch (RecordType) {
| case IMAGE_DESC_RECORD_TYPE:
| if (DGifGetImageDesc(GifFileIn) == GIF_ERROR)
| QuitGifError(GifFileIn, GifFileOut);
| [...]
| Width = GifFileIn->Image.Width;
| Height = GifFileIn->Image.Height;
| [...]
| /* Find the darkest color in color map to use as a filler. */
| ColorMap = (GifFileIn->Image.ColorMap ? GifFileIn->Image.ColorMap :
| GifFileIn->SColorMap);
| for (i = 0; i < ColorMap->ColorCount; i++) {
| j = ((int) ColorMap->Colors[i].Red) * 30 +
| ((int) ColorMap->Colors[i].Green) * 59 +
| ((int) ColorMap->Colors[i].Blue) * 11;
| if (j < ColorIntens) {
| ColorIntens = j;
| DarkestColor = i;
| }
| }
|
| /* Load the image, and dump it. */
| for (i = 0; i < Height; i++) {
| GifQprintf("\b\b\b\b%-4d", i);
| if (DGifGetLine(GifFileIn, LineBuffer, Width)
| == GIF_ERROR) break;
| if (EGifPutLine(GifFileOut, LineBuffer, Width)
| == GIF_ERROR) QuitGifError(GifFileIn, GifFileOut);
| }
|
| if (i < Height) {
| [...]
| /* Fill in with the darkest color in color map. */
| for (j = 0; j < Width; j++)
| LineBuffer[j] = DarkestColor;
| for (; i < Height; i++)
| if (EGifPutLine(GifFileOut, LineBuffer, Width)
| == GIF_ERROR) QuitGifError(GifFileIn, GifFileOut);
| }
| break;
| [...]
| }
| }
| while (RecordType != TERMINATE_RECORD_TYPE);
| [..]
| }
Comment 2 Adam Mariš 2015-12-21 10:13:59 EST
Public via:

http://seclists.org/oss-sec/2015/q4/548
Comment 3 Adam Mariš 2015-12-21 10:15:22 EST
Created giflib tracking bugs for this issue:

Affects: fedora-all [bug 1293371]
Comment 4 Adam Mariš 2015-12-21 10:15:31 EST
Created mingw-giflib tracking bugs for this issue:

Affects: fedora-all [bug 1293372]
Comment 5 Stefan Cornelius 2015-12-22 05:18:53 EST
GIF images contain two kinds of image dimension records. One is used to store the width and height of the logical screen and the other one is the image descriptor used to store the width and height of the image.

The problem is that the giffix utility uses the logical screen width to allocate memory for the GIF image, but then uses the image descriptor width to fill up said memory. This can lead to a heap-based buffer overflow when processing a specially crafted GIF image using the giffix utility.


Acknowledgements:

Red Hat would like to thank Hans Jerry Illikainen for reporting this issue.
Comment 7 Kurt Seifried 2015-12-23 12:53:48 EST
PhantomJS embeds part of giflib, but not the giffix utility, thus PhantomJS is not affected.
Comment 8 Kurt Seifried 2015-12-23 12:54:59 EST
Statement:

This issue affects the versions of giflib as shipped with Red Hat Enterprise Linux 5, 6 and 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Note You need to log in before you can comment on or make changes to this bug.