mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-10 00:04:06 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/giflib: patch CVE-2021-40633, CVE-2025-31344, CVE-2026-23868

Browse Source 
Fixes the following vulnerabilities:

- CVE-2021-40633:
    A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib
    5.1.4 allows remote attackers trigger an out of memory exception or
    denial of service via a gif format file.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2021-40633
  - ccbc956432/

- CVE-2025-31344:
    Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux.
    This vulnerability is associated with program files gif2rgb.C.  This
    issue affects giflib: through 5.2.2.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2025-31344
  - 7bbe8ea1a5

- CVE-2026-23868:
    Giflib contains a double-free vulnerability that is the result of a
    shallow copy in GifMakeSavedImage and incorrect error handling. The
    conditions needed to trigger this vulnerability are difficult but may
    be possible.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-23868
  - f5b7267aed

This package is still vulnerable to CVE-2024-45993 [1] & CVE-2026-26740
[2] that doesn't have a documented fix yet.

[1] https://security-tracker.debian.org/tracker/CVE-2024-45993
[2] https://security-tracker.debian.org/tracker/CVE-2026-26740

(cherry picked from commit 5388405cfd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Thomas Perale
2026-04-17 12:22:00 +02:00
parent 4afa94f4fb
commit 97203c48f9
4 changed files with 88 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
package/giflib/0003-CVE-2021-40633.patch Normal file
View File

@@ -0,0 +1,24 @@
commit ccbc956432650734c91acb3fc88837f7b81267ff
Author: Eric S. Raymond <esr@thyrsus.com>
Date: Wed Feb 21 18:55:00 2024 -0500
Clean up memory better at end of run (CVE-2021-40633)
CVE: CVE-2021-40633
Upstream: https://sourceforge.net/p/giflib/code/ci/ccbc956432650734c91acb3fc88837f7b81267ff/
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
diff --git a/gif2rgb.c b/gif2rgb.c
index d51226d..fc2e683 100644
--- a/gif2rgb.c
+++ b/gif2rgb.c
@@ -525,6 +525,9 @@ static void GIF2RGB(int NumFiles, char *FileName, bool OneFileFlag,
DumpScreen2RGB(OutFileName, OneFileFlag, ColorMap, ScreenBuffer,
GifFile->SWidth, GifFile->SHeight);
+ for (i = 0; i < GifFile->SHeight; i++) {
+ (void)free(ScreenBuffer[i]);
+ }
(void)free(ScreenBuffer);
{

26
package/giflib/0004-CVE-2025-31344.patch Normal file
View File

@@ -0,0 +1,26 @@
commit 7bbe8ea1a595bb7509ffa0a86b076e9b720e85af
Author: Eric S. Raymond <esr@thyrsus.com>
Date: Wed Feb 18 18:06:50 2026 -0500
Resolve SourceForge bug #187: CVE-2025-31344
CVE: CVE-2025-31344
Upstream: https://sourceforge.net/p/giflib/code/ci/7bbe8ea1a595bb7509ffa0a86b076e9b720e85af
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
diff --git a/gif2rgb.c b/gif2rgb.c
index b80ebcd..da4fa23 100644
--- a/gif2rgb.c
+++ b/gif2rgb.c
@@ -327,6 +327,11 @@ static void DumpScreen2RGB(char *FileName, int OneFileFlag,
GifRow = ScreenBuffer[i];
GifQprintf("\b\b\b\b%-4d", ScreenHeight - i);
for (j = 0; j < ScreenWidth; j++) {
+ /* Check if color is within color palete */
+ if (GifRow[j] >= ColorMap->ColorCount) {
+ GIF_EXIT(GifErrorString(
+ D_GIF_ERR_IMAGE_DEFECT));
+ }
ColorMapEntry = &ColorMap->Colors[GifRow[j]];
Buffers[0][j] = ColorMapEntry->Red;
Buffers[1][j] = ColorMapEntry->Green;

29
package/giflib/0005-CVE-2026-23868.patch Normal file
View File

@@ -0,0 +1,29 @@
commit f5b7267aed3665ef025c13823e454170d031c106
Author: Eric S. Raymond <esr@thyrsus.com>
Date: Wed Mar 4 18:49:49 2026 -0500
Avoid potentuial double-free on weird images.
CVE: CVE-2026-23868
Upstream: https://sourceforge.net/p/giflib/code/ci/f5b7267aed3665ef025c13823e454170d031c106
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
diff --git a/gifalloc.c b/gifalloc.c
index 01a845d..ff70cb0 100644
--- a/gifalloc.c
+++ b/gifalloc.c
@@ -349,6 +349,14 @@ SavedImage *GifMakeSavedImage(GifFileType *GifFile,
* aliasing problems.
*/
+ /* Null out aliased pointers before any allocations
+ * so that FreeLastSavedImage won't free CopyFrom's
+ * data if an allocation fails partway through. */
+ sp->ImageDesc.ColorMap = NULL;
+ sp->RasterBits = NULL;
+ sp->ExtensionBlocks = NULL;
+ sp->ExtensionBlockCount = 0;
+
/* first, the local color map */
if (CopyFrom->ImageDesc.ColorMap != NULL) {
sp->ImageDesc.ColorMap = GifMakeMapObject(

9
package/giflib/giflib.mk
View File

@@ -12,6 +12,15 @@ GIFLIB_LICENSE = MIT
GIFLIB_LICENSE_FILES = COPYING
GIFLIB_CPE_ID_VALID = YES
# 0003-CVE-2021-40633.patch
GIFLIB_IGNORE_CVES += CVE-2021-40633
# 0004-CVE-2025-31344.patch
GIFLIB_IGNORE_CVES += CVE-2025-31344
# 0005-CVE-2026-23868.patch
GIFLIB_IGNORE_CVES += CVE-2026-23868
ifeq ($(BR2_STATIC_LIBS),y)
GIFLIB_BUILD_LIBS = static-lib
GIFLIB_INSTALL_LIBS = install-static-lib