oss-security - Re: CVE-2025-31344: giflib: The giflib open-source component has a buffer overflow vulnerability.

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6a68cc9b-1667-4afe-9400-070315bf7563@pipping.org>
Date: Thu, 10 Apr 2025 02:20:48 +0200
From: Sebastian Pipping <sebastian@...ping.org>
To: oss-security@...ts.openwall.com, Bernhard Rosenkränzer
 <bero@...dev.ch>
Subject: Re: CVE-2025-31344: giflib: The giflib open-source
 component has a buffer overflow vulnerability.

Hello Bernhard,

On 09.04.25 23:23, Bernhard Rosenkränzer wrote:
> On Wednesday, April 09, 2025 23:11 CEST, Sebastian Pipping <sebastian@...ping.org> wrote:
>>     https://github.com/openwrt/packages/issues/26277
> 
> Except for https://sourceforge.net/p/giflib/bugs/179/, all the issues seem to be in gif2rgb, which is, according to the giflib maintainer, "old and crappy code", and TBH, other than as a no-dependency test tool for giflib, it is fairly useless (just use ImageMagick or a similar tool to do the gif to rgb conversion).
> Simply removing the gif2rgb tool is probably an acceptable solution.

I understand your take (and I believe Red Hat does just that: not 
include it with packaging [1]).

I would like to note that gif2rgb is currently shipped with e.g. Ubuntu
[2] and so just dropping that tool will break something somewhere.

On a side note ImageMagick (7.1.1.38) seems to ignore logical screen
size (section "18. Logical Screen Descriptor" of the spec [3]) in GIF
files:

   # file max_size.gif
   max_size.gif: GIF image data, version 89a, 65535 x 65535
                                              ^^^^^^^^^^^^^
   # magick max_size.gif max_size.png

   # file max_size.png
   max_size.png: PNG image data, 1 x 1, 8-bit gray+alpha, non-interlaced
                                 ^^^^^
Either I misunderstand the GIF spec or ImageMagick goes against
the spec and mis-converts this image.  (I tried other sizes to
be sure it's not an integer overflow issue but intention.)
So ImageMagick so far would not be my goto for GIF.  Happy to learn what
I'm missing.

So far I'm personally in favor of collaborative repair rather than
removal.  I'm probably biased because sibling tool gifbuild already
proved useful to me.

Best

Sebastian

[1] https://github.com/openela-main/giflib/blob/el9/SPECS/giflib.spec
[2] https://packages.ubuntu.com/oracular/amd64/giflib-tools/filelist
[3] https://www.w3.org/Graphics/GIF/spec-gif89a.txt

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.