cvs: gd /libgd ISSUES gd_gif_in.c /libgd/tests bug00005.c bug00005_1.gif bug00005_2.gif bug00005_3.gif

pajoye		Thu Sep 28 15:22:49 2006 UTC

  Added files:                 
    /gd/libgd/tests	bug00005_1.gif bug00005_2.gif bug00005_3.gif 
                   	bug00005.c 

  Modified files:              
    /gd/libgd	gd_gif_in.c ISSUES 
  Log:
  - GIF security fixes
  
  
http://cvs.php.net/viewvc.cgi/gd/libgd/gd_gif_in.c?r1=1.3&r2=1.4&diff_format=u
Index: gd/libgd/gd_gif_in.c
diff -u gd/libgd/gd_gif_in.c:1.3 gd/libgd/gd_gif_in.c:1.4
--- gd/libgd/gd_gif_in.c:1.3	Wed Apr  5 15:55:27 2006
+++ gd/libgd/gd_gif_in.c	Thu Sep 28 15:22:49 2006
@@ -42,7 +42,7 @@
 #define LOCALCOLORMAP  0x80
 #define BitSet(byte, bit)      (((byte) & (bit)) == (bit))
 
-#define        ReadOK(file,buffer,len) (gdGetBuf(buffer, len, file) != 0)
+#define        ReadOK(file,buffer,len) (gdGetBuf(buffer, len, file) > 0)
 
 #define LM_to_uint(a,b)                        (((b)<<8)|(a))
 
@@ -141,6 +141,8 @@
        Background      = buf[5];
        AspectRatio     = buf[6];
 #endif
+	   imw = LM_to_uint(buf[0],buf[1]);
+	   imh = LM_to_uint(buf[2],buf[3]);
 
        if (BitSet(buf[4], LOCALCOLORMAP)) {    /* Global Colormap */
                if (ReadColorMap(fd, BitPixel, ColorMap)) {
@@ -177,12 +179,17 @@
 
                bitPixel = 1<<((buf[8]&0x07)+1);
 
-               imw = LM_to_uint(buf[4],buf[5]);
-               imh = LM_to_uint(buf[6],buf[7]);
-	       if (!(im = gdImageCreate(imw, imh))) {
-			 return 0;
-	       }
-               im->interlace = BitSet(buf[8], INTERLACE);
+
+			   if (!useGlobalColormap) {
+				   if (ReadColorMap(fd, bitPixel, localColorMap)) {
+					   return 0;
+				   }
+			   }
+
+			   if (!(im = gdImageCreate(imw, imh))) {
+				   return 0;
+			   }
+			   im->interlace = BitSet(buf[8], INTERLACE);
                if (! useGlobalColormap) {
                        if (ReadColorMap(fd, bitPixel, localColorMap)) { 
                                  return 0;
@@ -205,6 +212,10 @@
        if (!im) {
 		return 0;
        }
+	   if (!im->colorsTotal) {
+		   gdImageDestroy(im);
+		   return 0;
+	   }
        /* Check for open colors at the end, so
           we can reduce colorsTotal and ultimately
           BitsPerPixel */
@@ -327,7 +338,7 @@
                buf[0] = buf[last_byte-2];
                buf[1] = buf[last_byte-1];
 
-               if ((count = GetDataBlock(fd, &buf[2], ZeroDataBlockP)) == 0)
+               if ((count = GetDataBlock(fd, &buf[2], ZeroDataBlockP)) <= 0)
                        done = TRUE;
 
                last_byte = 2 + count;
@@ -492,6 +503,18 @@
        int             v;
        int             xpos = 0, ypos = 0, pass = 0;
        int i;
+
+       /*
+       **  Initialize the Compression routines
+       */
+       if (! ReadOK(fd,&c,1)) {
+               return; 
+       }
+
+		if (c > MAX_LWZ_BITS) {
+			return;	
+		}
+
        /* Stash the color map into the image */
        for (i=0; (i<gdMaxColors); i++) {
                im->red[i] = cmap[CM_RED][i];	
@@ -501,12 +524,6 @@
        }
        /* Many (perhaps most) of these colors will remain marked open. */
        im->colorsTotal = gdMaxColors;
-       /*
-       **  Initialize the Compression routines
-       */
-       if (! ReadOK(fd,&c,1)) {
-               return; 
-       }
        if (LWZReadByte(fd, TRUE, c, ZeroDataBlockP) < 0) {
                return;
        }
http://cvs.php.net/viewvc.cgi/gd/libgd/ISSUES?r1=1.3&r2=1.4&diff_format=u
Index: gd/libgd/ISSUES
diff -u gd/libgd/ISSUES:1.3 gd/libgd/ISSUES:1.4
--- gd/libgd/ISSUES:1.3	Thu Sep 28 08:16:30 2006
+++ gd/libgd/ISSUES	Thu Sep 28 15:22:49 2006
@@ -6,3 +6,7 @@
   or invalid color index
 #3, gdImageRectangle draws corners twice (affects rectangles with alpha 
     channel)
+#4, to come
+
+#5, Numerous security fixes in GIF loader. When the gif palette is broken, 
+    the image size is invalid or NULL block at unexpected postions.

http://cvs.php.net/viewvc.cgi/gd/libgd/tests/bug00005.c?view=markup&rev=1.1
Index: gd/libgd/tests/bug00005.c
+++ gd/libgd/tests/bug00005.c
#include "gd.h"

int main()
{
 	gdImagePtr im;
	char * giffiles[3] = {"bug00005_1.gif", "bug00005_2.gif", "bug00005_3.gif"};

	FILE *fp;
	int i = 0;
	const int files_cnt = 3;

	for (i=0; i < files_cnt; i++) {
		fp = fopen(giffiles[i], "rb");
		if (!fp) {
			fprintf(stderr, "Input file does not exist!\n");
			return 1;
		}

		im = gdImageCreateFromGif(fp);

		if (!im) {
			fprintf(stderr, "%s Invalid GIF file\n", giffiles[i]);
		} else {
			fprintf(stderr, "%s valid GIF file\n", giffiles[i]);
		 	gdImageDestroy(im);
		}
	}

 	return 0;
}