31 lines
825 B
Diff
31 lines
825 B
Diff
From 99ba5c353373ed198f54af66fe4e355ebb96e363 Mon Sep 17 00:00:00 2001
|
|
From: LEPILLER Julien <julien@lepiller.eu>
|
|
Date: Thu, 3 Aug 2017 17:04:17 +0200
|
|
Subject: [PATCH] Fix #399: Buffer over-read into uninitialized memory.
|
|
|
|
The stack allocated color map buffers were not zeroed before usage, and
|
|
so undefined palette indexes could cause information leakage.
|
|
|
|
This is CVE-2017-7890.
|
|
---
|
|
src/gd_gif_in.c | 3 +++
|
|
1 file changed, 3 insertions(+)
|
|
|
|
diff --git a/src/gd_gif_in.c b/src/gd_gif_in.c
|
|
index 008d1ec..c195448 100644
|
|
--- a/src/gd_gif_in.c
|
|
+++ b/src/gd_gif_in.c
|
|
@@ -216,6 +216,9 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromGifCtx(gdIOCtxPtr fd)
|
|
|
|
gdImagePtr im = 0;
|
|
|
|
+ memset(ColorMap, 0, 3 * MAXCOLORMAPSIZE);
|
|
+ memset(localColorMap, 0, 3 * MAXCOLORMAPSIZE);
|
|
+
|
|
if(!ReadOK(fd, buf, 6)) {
|
|
return 0;
|
|
}
|
|
--
|
|
2.13.3
|
|
|