From 97203c48f9c36d87fe13fc0486d93718e4dcaa48 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Fri, 17 Apr 2026 12:22:00 +0200 Subject: [PATCH] package/giflib: patch CVE-2021-40633, CVE-2025-31344, CVE-2026-23868 Fixes the following vulnerabilities: - CVE-2021-40633: A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2021-40633 - https://sourceforge.net/p/giflib/code/ci/ccbc956432650734c91acb3fc88837f7b81267ff/ - CVE-2025-31344: Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C. This issue affects giflib: through 5.2.2. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2025-31344 - https://sourceforge.net/p/giflib/code/ci/7bbe8ea1a595bb7509ffa0a86b076e9b720e85af - CVE-2026-23868: Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but may be possible. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-23868 - https://sourceforge.net/p/giflib/code/ci/f5b7267aed3665ef025c13823e454170d031c106 This package is still vulnerable to CVE-2024-45993 [1] & CVE-2026-26740 [2] that doesn't have a documented fix yet. [1] https://security-tracker.debian.org/tracker/CVE-2024-45993 [2] https://security-tracker.debian.org/tracker/CVE-2026-26740 (cherry picked from commit 5388405cfd6df463ec01643d371ec9eef95360a7) Signed-off-by: Thomas Perale --- package/giflib/0003-CVE-2021-40633.patch | 24 ++++++++++++++++++++ package/giflib/0004-CVE-2025-31344.patch | 26 +++++++++++++++++++++ package/giflib/0005-CVE-2026-23868.patch | 29 ++++++++++++++++++++++++ package/giflib/giflib.mk | 9 ++++++++ 4 files changed, 88 insertions(+) create mode 100644 package/giflib/0003-CVE-2021-40633.patch create mode 100644 package/giflib/0004-CVE-2025-31344.patch create mode 100644 package/giflib/0005-CVE-2026-23868.patch diff --git a/package/giflib/0003-CVE-2021-40633.patch b/package/giflib/0003-CVE-2021-40633.patch new file mode 100644 index 0000000000..4e0070401e --- /dev/null +++ b/package/giflib/0003-CVE-2021-40633.patch @@ -0,0 +1,24 @@ +commit ccbc956432650734c91acb3fc88837f7b81267ff +Author: Eric S. Raymond +Date: Wed Feb 21 18:55:00 2024 -0500 + + Clean up memory better at end of run (CVE-2021-40633) + +CVE: CVE-2021-40633 +Upstream: https://sourceforge.net/p/giflib/code/ci/ccbc956432650734c91acb3fc88837f7b81267ff/ +Signed-off-by: Thomas Perale + +diff --git a/gif2rgb.c b/gif2rgb.c +index d51226d..fc2e683 100644 +--- a/gif2rgb.c ++++ b/gif2rgb.c +@@ -525,6 +525,9 @@ static void GIF2RGB(int NumFiles, char *FileName, bool OneFileFlag, + DumpScreen2RGB(OutFileName, OneFileFlag, ColorMap, ScreenBuffer, + GifFile->SWidth, GifFile->SHeight); + ++ for (i = 0; i < GifFile->SHeight; i++) { ++ (void)free(ScreenBuffer[i]); ++ } + (void)free(ScreenBuffer); + + { diff --git a/package/giflib/0004-CVE-2025-31344.patch b/package/giflib/0004-CVE-2025-31344.patch new file mode 100644 index 0000000000..2d74b526c4 --- /dev/null +++ b/package/giflib/0004-CVE-2025-31344.patch @@ -0,0 +1,26 @@ +commit 7bbe8ea1a595bb7509ffa0a86b076e9b720e85af +Author: Eric S. Raymond +Date: Wed Feb 18 18:06:50 2026 -0500 + + Resolve SourceForge bug #187: CVE-2025-31344 + +CVE: CVE-2025-31344 +Upstream: https://sourceforge.net/p/giflib/code/ci/7bbe8ea1a595bb7509ffa0a86b076e9b720e85af +Signed-off-by: Thomas Perale + +diff --git a/gif2rgb.c b/gif2rgb.c +index b80ebcd..da4fa23 100644 +--- a/gif2rgb.c ++++ b/gif2rgb.c +@@ -327,6 +327,11 @@ static void DumpScreen2RGB(char *FileName, int OneFileFlag, + GifRow = ScreenBuffer[i]; + GifQprintf("\b\b\b\b%-4d", ScreenHeight - i); + for (j = 0; j < ScreenWidth; j++) { ++ /* Check if color is within color palete */ ++ if (GifRow[j] >= ColorMap->ColorCount) { ++ GIF_EXIT(GifErrorString( ++ D_GIF_ERR_IMAGE_DEFECT)); ++ } + ColorMapEntry = &ColorMap->Colors[GifRow[j]]; + Buffers[0][j] = ColorMapEntry->Red; + Buffers[1][j] = ColorMapEntry->Green; diff --git a/package/giflib/0005-CVE-2026-23868.patch b/package/giflib/0005-CVE-2026-23868.patch new file mode 100644 index 0000000000..176325ef77 --- /dev/null +++ b/package/giflib/0005-CVE-2026-23868.patch @@ -0,0 +1,29 @@ +commit f5b7267aed3665ef025c13823e454170d031c106 +Author: Eric S. Raymond +Date: Wed Mar 4 18:49:49 2026 -0500 + + Avoid potentuial double-free on weird images. + +CVE: CVE-2026-23868 +Upstream: https://sourceforge.net/p/giflib/code/ci/f5b7267aed3665ef025c13823e454170d031c106 +Signed-off-by: Thomas Perale + +diff --git a/gifalloc.c b/gifalloc.c +index 01a845d..ff70cb0 100644 +--- a/gifalloc.c ++++ b/gifalloc.c +@@ -349,6 +349,14 @@ SavedImage *GifMakeSavedImage(GifFileType *GifFile, + * aliasing problems. + */ + ++ /* Null out aliased pointers before any allocations ++ * so that FreeLastSavedImage won't free CopyFrom's ++ * data if an allocation fails partway through. */ ++ sp->ImageDesc.ColorMap = NULL; ++ sp->RasterBits = NULL; ++ sp->ExtensionBlocks = NULL; ++ sp->ExtensionBlockCount = 0; ++ + /* first, the local color map */ + if (CopyFrom->ImageDesc.ColorMap != NULL) { + sp->ImageDesc.ColorMap = GifMakeMapObject( diff --git a/package/giflib/giflib.mk b/package/giflib/giflib.mk index 00922ce2db..db9886342c 100644 --- a/package/giflib/giflib.mk +++ b/package/giflib/giflib.mk @@ -12,6 +12,15 @@ GIFLIB_LICENSE = MIT GIFLIB_LICENSE_FILES = COPYING GIFLIB_CPE_ID_VALID = YES +# 0003-CVE-2021-40633.patch +GIFLIB_IGNORE_CVES += CVE-2021-40633 + +# 0004-CVE-2025-31344.patch +GIFLIB_IGNORE_CVES += CVE-2025-31344 + +# 0005-CVE-2026-23868.patch +GIFLIB_IGNORE_CVES += CVE-2026-23868 + ifeq ($(BR2_STATIC_LIBS),y) GIFLIB_BUILD_LIBS = static-lib GIFLIB_INSTALL_LIBS = install-static-lib