From 99ba5c353373ed198f54af66fe4e355ebb96e363 Mon Sep 17 00:00:00 2001 From: LEPILLER Julien Date: Thu, 3 Aug 2017 17:04:17 +0200 Subject: [PATCH] Fix #399: Buffer over-read into uninitialized memory. The stack allocated color map buffers were not zeroed before usage, and so undefined palette indexes could cause information leakage. This is CVE-2017-7890. --- src/gd_gif_in.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/gd_gif_in.c b/src/gd_gif_in.c index 008d1ec..c195448 100644 --- a/src/gd_gif_in.c +++ b/src/gd_gif_in.c @@ -216,6 +216,9 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromGifCtx(gdIOCtxPtr fd) gdImagePtr im = 0; + memset(ColorMap, 0, 3 * MAXCOLORMAPSIZE); + memset(localColorMap, 0, 3 * MAXCOLORMAPSIZE); + if(!ReadOK(fd, buf, 6)) { return 0; } -- 2.13.3