0002-Fix-420-Potential-infinite-loop-in-gdImageCreateFrom.patch 1.4 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061
  1. From a11f47475e6443b7f32d21f2271f28f417e2ac04 Mon Sep 17 00:00:00 2001
  2. From: "Christoph M. Becker" <cmbecker69@gmx.de>
  3. Date: Wed, 29 Nov 2017 19:37:38 +0100
  4. Subject: [PATCH] Fix #420: Potential infinite loop in gdImageCreateFromGifCtx
  5. Due to a signedness confusion in `GetCode_` a corrupt GIF file can
  6. trigger an infinite loop. Furthermore we make sure that a GIF without
  7. any palette entries is treated as invalid *after* open palette entries
  8. have been removed.
  9. CVE-2018-5711
  10. See also https://bugs.php.net/bug.php?id=75571.
  11. [Peter: drop tests]
  12. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
  13. ---
  14. src/gd_gif_in.c | 12 ++++++------
  15. 1 files changed, 38 insertions(+), 6 deletions(-)
  16. diff --git a/src/gd_gif_in.c b/src/gd_gif_in.c
  17. index daf26e7..0a8bd71 100644
  18. --- a/src/gd_gif_in.c
  19. +++ b/src/gd_gif_in.c
  20. @@ -335,11 +335,6 @@ terminated:
  21. return 0;
  22. }
  23. - if(!im->colorsTotal) {
  24. - gdImageDestroy(im);
  25. - return 0;
  26. - }
  27. -
  28. /* Check for open colors at the end, so
  29. * we can reduce colorsTotal and ultimately
  30. * BitsPerPixel */
  31. @@ -351,6 +346,11 @@ terminated:
  32. }
  33. }
  34. + if(!im->colorsTotal) {
  35. + gdImageDestroy(im);
  36. + return 0;
  37. + }
  38. +
  39. return im;
  40. }
  41. @@ -447,7 +447,7 @@ static int
  42. GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroDataBlockP)
  43. {
  44. int i, j, ret;
  45. - unsigned char count;
  46. + int count;
  47. if(flag) {
  48. scd->curbit = 0;
  49. --
  50. 2.20.1