Mohmamed Mohamed Elnady

Correction — please use these attachments instead of the earlier 0004–0006. The previously attached patches contained leftover merge-conflict markers in the gifalloc hunks — a commit-tooling error on my side, caught during follow-up work. The corrected series (6 patches, all final-state, no fixup-on-fixup) supersedes them: 0004 (attached): gifalloc memory-safety hardening as one commit with all four fixes and full evidence: (1) stale ImageCount after GifFreeSavedImages() → OOB write in GifMakeSavedImage();...

Revised attachments (same numbers, updated contents) — posted before you spend time on the originals: • 0008 (tests): as originally written it depended on fixes from the other tickets I'm filing — applied standalone with only this ticket's patches, the quantize/encoder checks would fail and the NULL-callback checks would crash the test binary on unpatched constructors. Trimmed to this ticket's scope (8 checks); the other tickets carry their own test commits (0009/0010/0011), so make check stays green...

GifMakeSavedImage: stale ImageCount use-after-free and OOB write in the free/append lifecycle; self-aliased copy UAF; NULL-handling hardening