[libGD] #87 [Task opened] fix segfault when an invalid color index is present in the image data

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY.

A new Flyspray task has been opened.  Details are below.

User who did this - Pierre Joye (Pierre)

Attached to Project - libGD
Summary - fix segfault when an invalid color index is present in the image data
Task Type - Bug Report
Category - General
Status - New
Assigned To - 
Operating System - All
Severity - High
Priority - Urgent
Reported Version - 2.0.34
Due in Version - Undecided
Due Date - Undecided
Details - Report from Elliot <wccoder at gmail dot com>

In gd_gif_in.c:567 Values read from the data stream are not bounds-checked. An attacker can create values of v (type int) which are larger than the array im->open (256 bytes).

If the value of im->open[v] happens to be non-zero, it is overwritten with a zero on line 593. This corrupts the heap. The attacker can't control what value is overwritten (always 0), but they could control which bytes are overwritten. libgd should clamp values of v to be between acceptable values [0,255].

Note that values of v are clamped to 4096, since this is the maximum
number of bits per codeword that gd will accept, so it isn't an
arbitrary overwrite. It is enough to corrupt the heap and cause a DoS
though.

More information can be found at the following URL:
http://bugs.libgd.org/?do=details&task_id=87

You are receiving this message because you have requested it from the Flyspray bugtracking system.  If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.