#82 a bug in gif2rgb.c in giflib-5.1.2

[xqx12]

Hi,

We find a memory allocation whose size could be zero in gif2rgb.c. and It will result to several memory out of bound read and write. the bug in gif2rgb.c:386 :

386 if ((ScreenBuffer = (GifRowType *)
387 malloc(GifFile->SHeight * sizeof(GifRowType))) == NULL)
388 GIF_EXIT("Failed to allocate memory required, aborted.");

the details with valgrind as follows:
please see the attachment for the gif with bug.

++++++++++++++++++++
valgrind ./util/.libs/lt-gif2rgb /tmp/treescap.gif
==62379== Memcheck, a memory error detector
==62379== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==62379== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info
==62379== Command: ./util/.libs/lt-gif2rgb /tmp/treescap.gif
==62379==
==62379== Invalid write of size 8
==62379== at 0x402140: GIF2RGB (in /home/xqx/test/giflib-test/llvm-code/giflib-5.1.2/util/.libs/lt-gif2rgb)
==62379== by 0x4028CA: main (in /home/xqx/test/giflib-test/llvm-code/giflib-5.1.2/util/.libs/lt-gif2rgb)
==62379== Address 0x540d650 is 0 bytes after a block of size 0 alloc'd
==62379== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==62379== by 0x4020E1: GIF2RGB (in /home/xqx/test/giflib-test/llvm-code/giflib-5.1.2/util/.libs/lt-gif2rgb)
==62379== by 0x4028CA: main (in /home/xqx/test/giflib-test/llvm-code/giflib-5.1.2/util/.libs/lt-gif2rgb)
==62379==
==62379== Invalid read of size 8
==62379== at 0x402147: GIF2RGB (in /home/xqx/test/giflib-test/llvm-code/giflib-5.1.2/util/.libs/lt-gif2rgb)
==62379== by 0x4028CA: main (in /home/xqx/test/giflib-test/llvm-code/giflib-5.1.2/util/.libs/lt-gif2rgb)
==62379== Address 0x540d650 is 0 bytes after a block of size 0 alloc'd
==62379== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==62379== by 0x4020E1: GIF2RGB (in /home/xqx/test/giflib-test/llvm-code/giflib-5.1.2/util/.libs/lt-gif2rgb)
==62379== by 0x4028CA: main (in /home/xqx/test/giflib-test/llvm-code/giflib-5.1.2/util/.libs/lt-gif2rgb)
==62379==
==62379== Invalid read of size 8
==62379== at 0x402197: GIF2RGB (in /home/xqx/test/giflib-test/llvm-code/giflib-5.1.2/util/.libs/lt-gif2rgb)
==62379== by 0x4028CA: main (in /home/xqx/test/giflib-test/llvm-code/giflib-5.1.2/util/.libs/lt-gif2rgb)
==62379== Address 0x540d650 is 0 bytes after a block of size 0 alloc'd
==62379== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==62379== by 0x4020E1: GIF2RGB (in /home/xqx/test/giflib-test/llvm-code/giflib-5.1.2/util/.libs/lt-gif2rgb)
==62379== by 0x4028CA: main (in /home/xqx/test/giflib-test/llvm-code/giflib-5.1.2/util/.libs/lt-gif2rgb)
==62379==
==62379== Conditional jump or move depends on uninitialised value(s)
==62379== at 0x4E3AAB3: DGifSetupDecompress (in /home/xqx/test/giflib-test/llvm-code/giflib-5.1.2/lib/.libs/libgif.so.7.0.0)
==62379== by 0x4E39DEA: DGifGetImageDesc (in /home/xqx/test/giflib-test/llvm-code/giflib-5.1.2/lib/.libs/libgif.so.7.0.0)
==62379== by 0x4022CA: GIF2RGB (in /home/xqx/test/giflib-test/llvm-code/giflib-5.1.2/util/.libs/lt-gif2rgb)
==62379== by 0x4028CA: main (in /home/xqx/test/giflib-test/llvm-code/giflib-5.1.2/util/.libs/lt-gif2rgb)

++++++++++++++++++++++++++++++++++++

[Eric S. Raymond]

Fix pushed.