Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 2 Aug 2011 17:34:28 +0200
From: Thomas Biege <>
Subject: CVE request: GIF loader buffer overflow when initializing decompression tables

Hi folks,
this one might need a CVE-ID...

Tomas Hoger 2011-08-01 05:48:32 EDT

GDK's GIF image reader is based on David Koblas' code that is also used in
several other GIF image readers.  This code contained an input validation flaw.
 Input code size was read from input GIF file and used to initialize decoding
tables without checking the value, leading to buffer overflow.  Relevant GDK
code is:

  941 static int
  942 gif_prepare_lzw (GifContext *context)
  943 {
  946   if (!gif_read (context, &(context->lzw_set_code_size), 1)) {
  947       /*g_message (_("GIF: EOF / read error on image data\n"));*/
  948       return -1;
  949   }
  952   context->lzw_clear_code = 1 << context->lzw_set_code_size;
  962   for (i = 0; i < context->lzw_clear_code; ++i) {
  963       context->lzw_table[0][i] = 0;
  964       context->lzw_table[1][i] = i;
  965   }

The same flaw was previously reported for several other components that include
GIF reading code based on David Koblas' parser, such as: gd (CVE-2006-4484),
SDL_image (CVE-2007-6697), tk (CVE-2008-0553), netbpm (CVE-2008-0554), cups

This problem was corrected upstream long ago:

The fix can be found in all gdk-pixbuf versions embedded in gtk2 packages, but
it seems it never got it to stand-alone gdk-pixbuf version for gtk+ 1.x.

Gimp corrected this bug ~2 years after GDK:

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.