1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
|
From 9fa3abd2e61da18ed2b889704e4e252f0f5a95fe Mon Sep 17 00:00:00 2001
From: Mike Frysinger <vapier@gentoo.org>
Date: Fri, 26 Jan 2018 01:57:52 -0500
Subject: [PATCH] gif: fix out-of-bounds read w/corrupted lzw data
oss-fuzz pointed out:
gd_gif_in.c:605:16: runtime error: index 5595 out of bounds for type 'int [4096]'
Add some bounds checking on each code that we read from the file.
---
src/gd_gif_in.c | 8 ++++++++
tests/gif/CMakeLists.txt | 3 ++-
tests/gif/Makemodule.am | 2 ++
tests/gif/ossfuzz5700.c | 13 +++++++++++++
tests/gif/ossfuzz5700.gif | Bin 0 -> 30 bytes
6 files changed, 26 insertions(+), 1 deletion(-)
create mode 100644 tests/gif/ossfuzz5700.c
diff --git a/src/gd_gif_in.c b/src/gd_gif_in.c
index afc08bf7..daf26e79 100644
--- a/src/gd_gif_in.c
+++ b/src/gd_gif_in.c
@@ -601,6 +601,10 @@ LWZReadByte_(gdIOCtx *fd, LZW_STATIC_DATA *sd, char flag, int input_code_size, i
/* Bad compressed data stream */
return -1;
}
+ if(code >= (1 << MAX_LWZ_BITS)) {
+ /* Corrupted code */
+ return -1;
+ }
*sd->sp++ = sd->table[1][code];
@@ -610,6 +614,10 @@ LWZReadByte_(gdIOCtx *fd, LZW_STATIC_DATA *sd, char flag, int input_code_size, i
code = sd->table[0][code];
}
+ if(code >= (1 << MAX_LWZ_BITS)) {
+ /* Corrupted code */
+ return -1;
+ }
*sd->sp++ = sd->firstcode = sd->table[1][code];
diff --git a/tests/gif/CMakeLists.txt b/tests/gif/CMakeLists.txt
index 7d40cddc..2b73749e 100644
--- a/tests/gif/CMakeLists.txt
+++ b/tests/gif/CMakeLists.txt
@@ -3,6 +3,8 @@ LIST(APPEND TESTS_FILES
bug00181
bug00227
gif_null
+ ossfuzz5700
+ uninitialized_memory_read
)
IF(PNG_FOUND)
@@ -12,7 +14,6 @@ LIST(APPEND TESTS_FILES
bug00060
bug00066
gif_im2im
- uninitialized_memory_read
)
ENDIF(PNG_FOUND)
diff --git a/tests/gif/Makemodule.am b/tests/gif/Makemodule.am
index 0bdeab7e..3199438f 100644
--- a/tests/gif/Makemodule.am
+++ b/tests/gif/Makemodule.am
@@ -3,6 +3,7 @@ libgd_test_programs += \
gif/bug00181 \
gif/bug00227 \
gif/gif_null \
+ gif/ossfuzz5700 \
gif/uninitialized_memory_read
if HAVE_LIBPNG
@@ -24,4 +25,5 @@ EXTRA_DIST += \
gif/bug00060.gif \
gif/bug00066.gif \
gif/bug00066_exp.png \
+ gif/ossfuzz5700.gif \
gif/unitialized_memory_read.gif
diff --git a/tests/gif/ossfuzz5700.c b/tests/gif/ossfuzz5700.c
new file mode 100644
index 00000000..8fc9f88c
--- /dev/null
+++ b/tests/gif/ossfuzz5700.c
@@ -0,0 +1,13 @@
+#include <stdio.h>
+#include "gd.h"
+#include "gdtest.h"
+
+int main()
+{
+ gdImagePtr im;
+ FILE *fp = gdTestFileOpen("gif/ossfuzz5700.gif");
+ im = gdImageCreateFromGif(fp);
+ fclose(fp);
+ gdImageDestroy(im);
+ return 0;
+}
|
