Bug#785369: libimlib2: GIF loader: out-of-bounds read

Control: retitle -1 imlib2: CVE-2016-3994: GIF loader: out-of-bounds read Hi, On Fri, May 15, 2015 at 01:23:05PM +0200, Jakub Wilk wrote: > Package: libimlib2 > Version: 1.4.7-1 > Usertags: afl > > Loading the attached image causes out-of-bounds reads: > > $ valgrind ./debian/tmp/usr/bin/imlib2

Bug#785369: libimlib2: GIF loader: out-of-bounds read

Hello, (not being maintainer I hope following could still be useful.) For this example picture we get from libgif.so.4.1.6 in MakeMapObject an array of ColorCount*sizeof(GifColorType) = 4*3 = 12 bytes. Breakpoint 2, MakeMapObject (ColorCount=, ColorMap=ColorMap@entry=0x0) at gifalloc.c:65

Bug#785369: libimlib2: GIF loader: out-of-bounds read

Package: libimlib2 Version: 1.4.7-1 Usertags: afl Loading the attached image causes out-of-bounds reads: $ valgrind ./debian/tmp/usr/bin/imlib2_conv oob.gif oob.ppm ==8382== Memcheck, a memory error detector ==8382== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al. ==8382== Using