oss-security - CVE request: GIF loader buffer overflow when initializing decompression tables

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 2 Aug 2011 17:34:28 +0200
From: Thomas Biege <thomas@...e.de>
To: oss-security@...ts.openwall.com
Subject: CVE request: GIF loader buffer overflow when initializing decompression tables

Hi folks,
this one might need a CVE-ID...

https://bugzilla.redhat.com/show_bug.cgi?id=727081

Tomas Hoger 2011-08-01 05:48:32 EDT

GDK's GIF image reader is based on David Koblas' code that is also used in
several other GIF image readers.  This code contained an input validation flaw.
 Input code size was read from input GIF file and used to initialize decoding
tables without checking the value, leading to buffer overflow.  Relevant GDK
code is:

  941 static int
  942 gif_prepare_lzw (GifContext *context)
  943 {
    ...
  946   if (!gif_read (context, &(context->lzw_set_code_size), 1)) {
  947       /*g_message (_("GIF: EOF / read error on image data\n"));*/
  948       return -1;
  949   }
    ...
  952   context->lzw_clear_code = 1 << context->lzw_set_code_size;
    ...
  962   for (i = 0; i < context->lzw_clear_code; ++i) {
  963       context->lzw_table[0][i] = 0;
  964       context->lzw_table[1][i] = i;
  965   }

The same flaw was previously reported for several other components that include
GIF reading code based on David Koblas' parser, such as: gd (CVE-2006-4484),
SDL_image (CVE-2007-6697), tk (CVE-2008-0553), netbpm (CVE-2008-0554), cups
(CVE-2008-1373).

This problem was corrected upstream long ago:

http://git.gnome.org/browse/gdk-pixbuf/commit/gdk-pixbuf/io-gif.c?id=3bac204e0d0241a0d68586ece7099e6acf0e9bea

The fix can be found in all gdk-pixbuf versions embedded in gtk2 packages, but
it seems it never got it to stand-alone gdk-pixbuf version for gtk+ 1.x.

Gimp corrected this bug ~2 years after GDK:

http://git.gnome.org/browse/gimp/commit/plug-ins/common/gifload.c?id=cac290d093d0c318bbe33a4ff290c2abbd9698d3

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.