oss-sec mailing list archives

CVE-2025-31344: giflib: The giflib open-source component has a buffer overflow vulnerability.


From: 李亚杰 <liyajie () openeuler sh>
Date: Mon, 07 Apr 2025 21:15:25 +0800

Affected Versions:
- giflib 5.2.2 and below

Description:
In the function DumpScreen2RGB of the giflib software, an attempt is made to access the color map through 
ColorMapEntry. The size of ColorMap is 6 bytes (from 0x602000000030 to 0x602000000036). However, when accessing 
ColorMap->Colors[GifRow[j]], the value of GifRow[j] exceeds the actual number of colors stored. The address pointed to 
by ColorMapEntry, 0x602000000039, goes beyond the allocated memory range for color data. As a result, accessing 
ColorMapEntry->Red leads to out-of-bounds access, causing a heap-buffer-overflow.

Credits:
JiaXuan Song(m202372152 () hust edu cn)
bale.cen(cenxianlong () huawei com)

Best Regards,
Yajie Li


Current thread: