Bug 1290785 (CVE-2015-7555) - CVE-2015-7555 giflib: Heap-based buffer overflow in giffix utility
Summary: CVE-2015-7555 giflib: Heap-based buffer overflow in giffix utility
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2015-7555
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1293371 1293372
Blocks: 1290786
TreeView+ depends on / blocked
 
Reported: 2015-12-11 13:02 UTC by Adam Mariš
Modified: 2019-09-29 13:40 UTC (History)
19 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-12-23 17:54:59 UTC


Attachments (Terms of Use)

Description Adam Mariš 2015-12-11 13:02:20 UTC
A heap-based buffer overflow vulnerability was found in giffix utility of giflib when processing records of the type `IMAGE_DESC_RECORD_TYPE' due to the allocated size of `LineBuffer' equaling the value of the logical screen width, `GifFileIn->SWidth', while subsequently having `GifFileIn->Image.Width' bytes of data written to it.

Vulnerable code:

giflib-5.1.1/util/giffix.c #35..194:
| int main(int argc, char **argv)
| {
| [...]
| if ((LineBuffer = (GifRowType) malloc(GifFileIn->SWidth)) == NULL)
| GIF_EXIT("Failed to allocate memory required, aborted.");
|
| /* Scan the content of the GIF file and load the image(s) in: */
| do {
| [...]
| switch (RecordType) {
| case IMAGE_DESC_RECORD_TYPE:
| if (DGifGetImageDesc(GifFileIn) == GIF_ERROR)
| QuitGifError(GifFileIn, GifFileOut);
| [...]
| Width = GifFileIn->Image.Width;
| Height = GifFileIn->Image.Height;
| [...]
| /* Find the darkest color in color map to use as a filler. */
| ColorMap = (GifFileIn->Image.ColorMap ? GifFileIn->Image.ColorMap :
| GifFileIn->SColorMap);
| for (i = 0; i < ColorMap->ColorCount; i++) {
| j = ((int) ColorMap->Colors[i].Red) * 30 +
| ((int) ColorMap->Colors[i].Green) * 59 +
| ((int) ColorMap->Colors[i].Blue) * 11;
| if (j < ColorIntens) {
| ColorIntens = j;
| DarkestColor = i;
| }
| }
|
| /* Load the image, and dump it. */
| for (i = 0; i < Height; i++) {
| GifQprintf("\b\b\b\b%-4d", i);
| if (DGifGetLine(GifFileIn, LineBuffer, Width)
| == GIF_ERROR) break;
| if (EGifPutLine(GifFileOut, LineBuffer, Width)
| == GIF_ERROR) QuitGifError(GifFileIn, GifFileOut);
| }
|
| if (i < Height) {
| [...]
| /* Fill in with the darkest color in color map. */
| for (j = 0; j < Width; j++)
| LineBuffer[j] = DarkestColor;
| for (; i < Height; i++)
| if (EGifPutLine(GifFileOut, LineBuffer, Width)
| == GIF_ERROR) QuitGifError(GifFileIn, GifFileOut);
| }
| break;
| [...]
| }
| }
| while (RecordType != TERMINATE_RECORD_TYPE);
| [..]
| }

Comment 2 Adam Mariš 2015-12-21 15:13:59 UTC
Public via:

http://seclists.org/oss-sec/2015/q4/548

Comment 3 Adam Mariš 2015-12-21 15:15:22 UTC
Created giflib tracking bugs for this issue:

Affects: fedora-all [bug 1293371]

Comment 4 Adam Mariš 2015-12-21 15:15:31 UTC
Created mingw-giflib tracking bugs for this issue:

Affects: fedora-all [bug 1293372]

Comment 5 Stefan Cornelius 2015-12-22 10:18:53 UTC
GIF images contain two kinds of image dimension records. One is used to store the width and height of the logical screen and the other one is the image descriptor used to store the width and height of the image.

The problem is that the giffix utility uses the logical screen width to allocate memory for the GIF image, but then uses the image descriptor width to fill up said memory. This can lead to a heap-based buffer overflow when processing a specially crafted GIF image using the giffix utility.


Acknowledgements:

Red Hat would like to thank Hans Jerry Illikainen for reporting this issue.

Comment 7 Kurt Seifried 2015-12-23 17:53:48 UTC
PhantomJS embeds part of giflib, but not the giffix utility, thus PhantomJS is not affected.

Comment 8 Kurt Seifried 2015-12-23 17:54:59 UTC
Statement:

This issue affects the versions of giflib as shipped with Red Hat Enterprise Linux 5, 6 and 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.


Note You need to log in before you can comment on or make changes to this bug.