Menu ▾ ▴

#210 Double-free in GifMakeSavedImage (sibling of CVE-2026-23868)

v1.0_(example)
open
nobody
None
1
2026-10-10
2026-10-10
No

The fix for CVE-2026-23868 did deep-copy of ColorMap/RasterBits but the extension blocks copy is still a memcpy of structs, leaving Bytes pointers aliased, causing double-free when both are freed. PoC verified (SIGABRT double free detected in tcache 2). The attached patch does deep-copy of ExtensionBlock.Bytes and NULLs the source.

1 Attachments

Discussion


Log in to post a comment.