diff --git a/package/giflib/0003-CVE-2021-40633.patch b/package/giflib/0003-CVE-2021-40633.patch new file mode 100644 index 0000000000..4e0070401e --- /dev/null +++ b/package/giflib/0003-CVE-2021-40633.patch @@ -0,0 +1,24 @@ +commit ccbc956432650734c91acb3fc88837f7b81267ff +Author: Eric S. Raymond +Date: Wed Feb 21 18:55:00 2024 -0500 + + Clean up memory better at end of run (CVE-2021-40633) + +CVE: CVE-2021-40633 +Upstream: https://sourceforge.net/p/giflib/code/ci/ccbc956432650734c91acb3fc88837f7b81267ff/ +Signed-off-by: Thomas Perale + +diff --git a/gif2rgb.c b/gif2rgb.c +index d51226d..fc2e683 100644 +--- a/gif2rgb.c ++++ b/gif2rgb.c +@@ -525,6 +525,9 @@ static void GIF2RGB(int NumFiles, char *FileName, bool OneFileFlag, + DumpScreen2RGB(OutFileName, OneFileFlag, ColorMap, ScreenBuffer, + GifFile->SWidth, GifFile->SHeight); + ++ for (i = 0; i < GifFile->SHeight; i++) { ++ (void)free(ScreenBuffer[i]); ++ } + (void)free(ScreenBuffer); + + { diff --git a/package/giflib/0004-CVE-2025-31344.patch b/package/giflib/0004-CVE-2025-31344.patch new file mode 100644 index 0000000000..2d74b526c4 --- /dev/null +++ b/package/giflib/0004-CVE-2025-31344.patch @@ -0,0 +1,26 @@ +commit 7bbe8ea1a595bb7509ffa0a86b076e9b720e85af +Author: Eric S. Raymond +Date: Wed Feb 18 18:06:50 2026 -0500 + + Resolve SourceForge bug #187: CVE-2025-31344 + +CVE: CVE-2025-31344 +Upstream: https://sourceforge.net/p/giflib/code/ci/7bbe8ea1a595bb7509ffa0a86b076e9b720e85af +Signed-off-by: Thomas Perale + +diff --git a/gif2rgb.c b/gif2rgb.c +index b80ebcd..da4fa23 100644 +--- a/gif2rgb.c ++++ b/gif2rgb.c +@@ -327,6 +327,11 @@ static void DumpScreen2RGB(char *FileName, int OneFileFlag, + GifRow = ScreenBuffer[i]; + GifQprintf("\b\b\b\b%-4d", ScreenHeight - i); + for (j = 0; j < ScreenWidth; j++) { ++ /* Check if color is within color palete */ ++ if (GifRow[j] >= ColorMap->ColorCount) { ++ GIF_EXIT(GifErrorString( ++ D_GIF_ERR_IMAGE_DEFECT)); ++ } + ColorMapEntry = &ColorMap->Colors[GifRow[j]]; + Buffers[0][j] = ColorMapEntry->Red; + Buffers[1][j] = ColorMapEntry->Green; diff --git a/package/giflib/0005-CVE-2026-23868.patch b/package/giflib/0005-CVE-2026-23868.patch new file mode 100644 index 0000000000..176325ef77 --- /dev/null +++ b/package/giflib/0005-CVE-2026-23868.patch @@ -0,0 +1,29 @@ +commit f5b7267aed3665ef025c13823e454170d031c106 +Author: Eric S. Raymond +Date: Wed Mar 4 18:49:49 2026 -0500 + + Avoid potentuial double-free on weird images. + +CVE: CVE-2026-23868 +Upstream: https://sourceforge.net/p/giflib/code/ci/f5b7267aed3665ef025c13823e454170d031c106 +Signed-off-by: Thomas Perale + +diff --git a/gifalloc.c b/gifalloc.c +index 01a845d..ff70cb0 100644 +--- a/gifalloc.c ++++ b/gifalloc.c +@@ -349,6 +349,14 @@ SavedImage *GifMakeSavedImage(GifFileType *GifFile, + * aliasing problems. + */ + ++ /* Null out aliased pointers before any allocations ++ * so that FreeLastSavedImage won't free CopyFrom's ++ * data if an allocation fails partway through. */ ++ sp->ImageDesc.ColorMap = NULL; ++ sp->RasterBits = NULL; ++ sp->ExtensionBlocks = NULL; ++ sp->ExtensionBlockCount = 0; ++ + /* first, the local color map */ + if (CopyFrom->ImageDesc.ColorMap != NULL) { + sp->ImageDesc.ColorMap = GifMakeMapObject( diff --git a/package/giflib/giflib.mk b/package/giflib/giflib.mk index 00922ce2db..db9886342c 100644 --- a/package/giflib/giflib.mk +++ b/package/giflib/giflib.mk @@ -12,6 +12,15 @@ GIFLIB_LICENSE = MIT GIFLIB_LICENSE_FILES = COPYING GIFLIB_CPE_ID_VALID = YES +# 0003-CVE-2021-40633.patch +GIFLIB_IGNORE_CVES += CVE-2021-40633 + +# 0004-CVE-2025-31344.patch +GIFLIB_IGNORE_CVES += CVE-2025-31344 + +# 0005-CVE-2026-23868.patch +GIFLIB_IGNORE_CVES += CVE-2026-23868 + ifeq ($(BR2_STATIC_LIBS),y) GIFLIB_BUILD_LIBS = static-lib GIFLIB_INSTALL_LIBS = install-static-lib