A heap-based buffer overflow vulnerability was found in giffix utility of giflib when processing records of the type `IMAGE_DESC_RECORD_TYPE' due to the allocated size of `LineBuffer' equaling the value of the logical screen width, `GifFileIn->SWidth', while subsequently having `GifFileIn->Image.Width' bytes of data written to it. Vulnerable code: giflib-5.1.1/util/giffix.c #35..194: | int main(int argc, char **argv) | { | [...] | if ((LineBuffer = (GifRowType) malloc(GifFileIn->SWidth)) == NULL) | GIF_EXIT("Failed to allocate memory required, aborted."); | | /* Scan the content of the GIF file and load the image(s) in: */ | do { | [...] | switch (RecordType) { | case IMAGE_DESC_RECORD_TYPE: | if (DGifGetImageDesc(GifFileIn) == GIF_ERROR) | QuitGifError(GifFileIn, GifFileOut); | [...] | Width = GifFileIn->Image.Width; | Height = GifFileIn->Image.Height; | [...] | /* Find the darkest color in color map to use as a filler. */ | ColorMap = (GifFileIn->Image.ColorMap ? GifFileIn->Image.ColorMap : | GifFileIn->SColorMap); | for (i = 0; i < ColorMap->ColorCount; i++) { | j = ((int) ColorMap->Colors[i].Red) * 30 + | ((int) ColorMap->Colors[i].Green) * 59 + | ((int) ColorMap->Colors[i].Blue) * 11; | if (j < ColorIntens) { | ColorIntens = j; | DarkestColor = i; | } | } | | /* Load the image, and dump it. */ | for (i = 0; i < Height; i++) { | GifQprintf("\b\b\b\b%-4d", i); | if (DGifGetLine(GifFileIn, LineBuffer, Width) | == GIF_ERROR) break; | if (EGifPutLine(GifFileOut, LineBuffer, Width) | == GIF_ERROR) QuitGifError(GifFileIn, GifFileOut); | } | | if (i < Height) { | [...] | /* Fill in with the darkest color in color map. */ | for (j = 0; j < Width; j++) | LineBuffer[j] = DarkestColor; | for (; i < Height; i++) | if (EGifPutLine(GifFileOut, LineBuffer, Width) | == GIF_ERROR) QuitGifError(GifFileIn, GifFileOut); | } | break; | [...] | } | } | while (RecordType != TERMINATE_RECORD_TYPE); | [..] | }
Public via: http://seclists.org/oss-sec/2015/q4/548
Created giflib tracking bugs for this issue: Affects: fedora-all [bug 1293371]
Created mingw-giflib tracking bugs for this issue: Affects: fedora-all [bug 1293372]
GIF images contain two kinds of image dimension records. One is used to store the width and height of the logical screen and the other one is the image descriptor used to store the width and height of the image. The problem is that the giffix utility uses the logical screen width to allocate memory for the GIF image, but then uses the image descriptor width to fill up said memory. This can lead to a heap-based buffer overflow when processing a specially crafted GIF image using the giffix utility. Acknowledgements: Red Hat would like to thank Hans Jerry Illikainen for reporting this issue.
PhantomJS embeds part of giflib, but not the giffix utility, thus PhantomJS is not affected.
Statement: This issue affects the versions of giflib as shipped with Red Hat Enterprise Linux 5, 6 and 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.