#79 Invalid heap read in gif2rgb, function DumpScreen2RGB()

[Hanno Böck]

The attached file will cause an out of bounds heap read in gif2rgb. This can be seen with either valgrind or address sanitizer. I'll attach the full output of address sanitizer as well.
This issue was found with american fuzzy lop.

[Eric S. Raymond]

Fixed in head, thanks.

[Eric S. Raymond]

Fixed in head, thanks.

[Hanno Böck]

I don't see a fix for this, this is still happening in the current git head code.
Have you actually pushed the commit? (I only see a fix for bug #78)

[Eric S. Raymond]

The bug is definitely failing to reproduce here, I re-downloded your test case and checked.

[Hanno Böck]

How have you tried to reproduce it? (I wrote that this can be seen with valgrind in my original report, but that seems not to be the case - address sanitizer is usually more powerful in finding these kinds of issues)

The exact steps here how I can still reproduce it:
git clone --depth=1 git://git.code.sf.net/p/giflib/code giflib-code
cd giflib-code/
CFLAGS="-fsanitize=address -g" LDFLAGS="-fsanitize=address" ./autogen.sh
make
wget https://sourceforge.net/p/giflib/bugs/79/attachment/gif2rgb-oob-heap-read.gif
util/gif2rgb gif2rgb-oob-heap-read.gif

[Eric S. Raymond]

"Hanno Böck" ctulhu@users.sf.net:

How have you tried to reproduce it? (I wrote that this can be seen with valgrind in my original report, but that seems not to be the case - address sanitizer is usually more powerful in finding these kinds of issues)

The exact steps here how I can still reproduce it:
git clone --depth=1 git://git.code.sf.net/p/giflib/code giflib-code
cd giflib-code/
CFLAGS="-fsanitize=address -g" LDFLAGS="-fsanitize=address" ./autogen.sh
make
wget https://sourceforge.net/p/giflib/bugs/79/attachment/gif2rgb-oob-heap-read.gif
util/gif2rgb gif2rgb-oob-heap-read.gif

I have added a couple of hardening patches recently. Would you please retest.

    <a href="http://www.catb.org/~esr/">Eric S. Raymond</a>

[Hanno Böck]

Tested again with latest git code, no change. bug still there.

[Sebastian Pipping]

I used git bisect now and found that releases <5.1.5 are affected. Commit https://sourceforge.net/p/giflib/code/ci/ea8dbc5786862a3e16a5acfa3d24e2c2f608cd88/ has an apparent fix, issue #87 is related.

CC @ctulhu