tags 395382 + patch
thanks

Hi,

Attached please find my proposed NMU patch for this bug.  Feel free to
take over it and include it in a maintainer upload.  However, if I don't
hear from you within the next several days (let's say, by November 3rd)
I will upload myself.

best regards,

-- 
Kevin B. McCarty <[EMAIL PROTECTED]>   Physics Department
WWW: http://www.princeton.edu/~kmccarty/    Princeton University
GPG: public key ID 4F83C751                 Princeton, NJ 08544
diff -ur giflib-3.0.old/debian/changelog giflib-3.0/debian/changelog
--- giflib-3.0.old/debian/changelog     2006-10-26 13:57:08.000000000 -0400
+++ giflib-3.0/debian/changelog 2006-10-26 13:55:19.108418553 -0400
@@ -1,3 +1,16 @@
+giflib (3.0-12.1) unstable; urgency=high
+
+  * Non-maintainer upload for security patch.
+  * Backport fixes from giflib 4.1.4:
+    - lib/dgif_lib.c: Fix NULL dereference crash with crafted LZW
+      termination blocks.  CVE-2005-2974
+    - lib/dgif_lib.c, lib/egif_lib.c, lib/gifalloc.c, util/gifcomb.c:
+      Fix multiple buffer overflows with crafted GIF files, possibly
+      exploitable.  CVE-2005-3350
+    - closes: #395382
+
+ -- Kevin B. McCarty <[EMAIL PROTECTED]>  Thu, 26 Oct 2006 13:45:43 -0400
+
 giflib (3.0-12) unstable; urgency=low
 
   * Applied patch from Dann Frazier <[EMAIL PROTECTED]> to fix problems on 
64-bit
diff -ur giflib-3.0.old/lib/dgif_lib.c giflib-3.0/lib/dgif_lib.c
--- giflib-3.0.old/lib/dgif_lib.c       1997-06-26 13:09:56.000000000 -0400
+++ giflib-3.0/lib/dgif_lib.c   2006-10-26 12:49:24.418823486 -0400
@@ -492,14 +492,26 @@
 
     File = Private->File;
 
-    if (GifFile->Image.ColorMap)
+    if (GifFile->Image.ColorMap) {
        FreeMapObject(GifFile->Image.ColorMap);
-    if (GifFile->SColorMap)
+       GifFile->Image.ColorMap = NULL;
+    }
+    
+    if (GifFile->SColorMap) {
        FreeMapObject(GifFile->SColorMap);
-    if (Private)
+       GifFile->SColorMap = NULL;
+    }
+    
+    if (Private) {
        free((char *) Private);
-    if (GifFile->SavedImages)
+       Private = NULL;
+    }
+    
+    if (GifFile->SavedImages) {
        FreeSavedImages(GifFile);
+       GifFile->SavedImages = NULL;
+    }
+    
     free(GifFile);
 
     if (fclose(File) != 0) {
@@ -805,6 +817,11 @@
        0x00ff, 0x01ff, 0x03ff, 0x07ff,
        0x0fff
     };
+    /* The image can't contain more than LZ_BITS per code. */
+    if (Private->RunningBits > LZ_BITS) {
+        _GifError = D_GIF_ERR_IMAGE_DEFECT;
+       return GIF_ERROR;
+    }
 
     while (Private->CrntShiftState < Private->RunningBits) {
        /* Needs to get more bytes from input stream for next code: */
@@ -821,9 +838,13 @@
     Private->CrntShiftDWord >>= Private->RunningBits;
     Private->CrntShiftState -= Private->RunningBits;
 
-    /* If code cannt fit into RunningBits bits, must raise its size. Note */
-    /* however that codes above 4095 are used for special signaling.      */
-    if (++Private->RunningCode > Private->MaxCode1 &&
+    /* If code cannt fit into RunningBits bits, must raise its size. Note
+     * however that codes above 4095 are used for special signaling.
+     * If we're using LZ_BITS bits already and we're at the max code, just
+     * keep using the table as it is, don't increment Private->RunningCode.
+     */
+    if (Private->RunningCode < LZ_MAX_CODE + 2 &&
+       ++Private->RunningCode > Private->MaxCode1 &&
        Private->RunningBits < LZ_BITS) {
        Private->MaxCode1 <<= 1;
        Private->RunningBits++;
@@ -847,6 +868,14 @@
            _GifError = D_GIF_ERR_READ_FAILED;
            return GIF_ERROR;
        }
+       /* There shouldn't be any empty data blocks here as the LZW spec
+        * says the LZW termination code should come first.  Therefore we
+        * shouldn't be inside this routine at that point.
+        */
+       if (Buf[0] == 0) {
+           _GifError = D_GIF_ERR_IMAGE_DEFECT;
+           return GIF_ERROR;
+       }
        if (fread(&Buf[1], 1, Buf[0], File) != Buf[0])
        {
            _GifError = D_GIF_ERR_READ_FAILED;
diff -ur giflib-3.0.old/lib/egif_lib.c giflib-3.0/lib/egif_lib.c
--- giflib-3.0.old/lib/egif_lib.c       2006-10-26 13:57:08.000000000 -0400
+++ giflib-3.0/lib/egif_lib.c   2006-10-26 12:58:03.869314228 -0400
@@ -598,10 +598,14 @@
     Buf = ';';
     fwrite(&Buf, 1, 1, Private->File);
 
-    if (GifFile->Image.ColorMap)
+    if (GifFile->Image.ColorMap) {
        FreeMapObject(GifFile->Image.ColorMap);
-    if (GifFile->SColorMap)
+       GifFile->Image.ColorMap = NULL;
+    }
+    if (GifFile->SColorMap) {
        FreeMapObject(GifFile->SColorMap);
+       GifFile->SColorMap = NULL;
+    }
     if (Private) {
        if (Private->HashTable) free((char *) Private->HashTable);
        free((char *) Private);
diff -ur giflib-3.0.old/lib/gifalloc.c giflib-3.0/lib/gifalloc.c
--- giflib-3.0.old/lib/gifalloc.c       2006-10-26 13:57:08.000000000 -0400
+++ giflib-3.0/lib/gifalloc.c   2006-10-26 12:34:25.128104179 -0400
@@ -326,8 +326,10 @@
         sp < GifFile->SavedImages + GifFile->ImageCount;
         sp++)
     {
-       if (sp->ImageDesc.ColorMap)
+       if (sp->ImageDesc.ColorMap) {
            FreeMapObject(sp->ImageDesc.ColorMap);
+           sp->ImageDesc.ColorMap = NULL;
+       }
 
        if (sp->RasterBits)
            free((char *)sp->RasterBits);
diff -ur giflib-3.0.old/util/gifcomb.c giflib-3.0/util/gifcomb.c
--- giflib-3.0.old/util/gifcomb.c       2006-10-26 13:57:08.000000000 -0400
+++ giflib-3.0/util/gifcomb.c   2006-10-26 12:35:30.365232173 -0400
@@ -196,6 +196,7 @@
     }
 
     FreeMapObject(ColorUnion);             /* We dont need this any more... */
+    ColorUnion = NULL;
 
     if (DGifCloseFile(GifFileIn1) == GIF_ERROR ||
        DGifCloseFile(GifFileIn2) == GIF_ERROR ||

Reply via email to