[packages/giflib4] Rel 4. security fixes
arekm
arekm at pld-linux.org
Tue Oct 20 21:57:12 CEST 2026
commit eb0c7b705b63639f8e870e76de79b5cbc4fe4e0d
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Tue Oct 20 21:51:48 2026 +0200
Rel 4. security fixes
giflib4-CVE-2015-7555.patch | 14 +++++++++
giflib4-CVE-2026-23868.patch | 74 ++++++++++++++++++++++++++++++++++++++++++++
giflib4-dgif-bounds.patch | 27 ++++++++++++++++
giflib4-gif2rgb-bounds.patch | 39 +++++++++++++++++++++++
giflib4.spec | 30 +++++++++++-------
5 files changed, 173 insertions(+), 11 deletions(-)
---
diff --git a/giflib4.spec b/giflib4.spec
index 051b73d..1556f9d 100644
--- a/giflib4.spec
+++ b/giflib4.spec
@@ -10,7 +10,7 @@ Summary(ru.UTF-8): Библиотека для работы с GIF-файлам
Summary(uk.UTF-8): Бібліотека для роботи з GIF-файлами
Name: giflib4
Version: 4.2.3
-Release: 3
+Release: 4
License: MIT-like
Group: Libraries
Source0: https://downloads.sourceforge.net/giflib/giflib-%{version}.tar.bz2
@@ -19,6 +19,10 @@ Patch0: %{name}-link.patch
Patch1: %{name}-includes.patch
Patch2: %{name}-lib-no-x11.patch
Patch3: %{name}-getarg-bool.patch
+Patch4: %{name}-CVE-2015-7555.patch
+Patch5: %{name}-dgif-bounds.patch
+Patch6: %{name}-gif2rgb-bounds.patch
+Patch7: %{name}-CVE-2026-23868.patch
URL: https://sourceforge.net/projects/giflib/
BuildRequires: autoconf >= 2.59-9
BuildRequires: automake
@@ -34,8 +38,8 @@ Provides: libungif.so.4
%endif
Provides: libungif
Obsoletes: giflib < 5
-Obsoletes: libungif
-Obsoletes: libungif4
+Obsoletes: libungif < 5
+Obsoletes: libungif4 < 5
BuildRoot: %{tmpdir}/%{name}-%{version}-root-%(id -u -n)
%description
@@ -71,8 +75,8 @@ Group: Development/Libraries
Requires: %{name} = %{version}-%{release}
Provides: libungif-devel
Obsoletes: giflib-devel < 5
-Obsoletes: libungif-devel
-Obsoletes: libungif4-devel
+Obsoletes: libungif-devel < 5
+Obsoletes: libungif4-devel < 5
%description devel
Libraries and headers needed for developing programs that use libgif
@@ -109,7 +113,7 @@ Group: Development/Libraries
Requires: %{name}-devel = %{version}-%{release}
Provides: libungif-static
Obsoletes: giflib-static < 5
-Obsoletes: libungif-static
+Obsoletes: libungif-static < 5
%description static
Static libraries needed for developing programs that use libgif to
@@ -138,7 +142,7 @@ Group: Applications/Graphics
Requires: %{name} = %{version}-%{release}
Provides: libungif-progs
Obsoletes: giflib-progs < 5
-Obsoletes: libungif-progs
+Obsoletes: libungif-progs < 5
%description progs
This package contains various programs for manipulating GIF image
@@ -160,6 +164,10 @@ GIF.
%patch -P1 -p1
%patch -P2 -p1
%patch -P3 -p1
+%patch -P4 -p1
+%patch -P5 -p1
+%patch -P6 -p1
+%patch -P7 -p1
%build
%{__libtoolize}
@@ -197,14 +205,14 @@ rm -rf $RPM_BUILD_ROOT
%defattr(644,root,root,755)
%doc AUTHORS BUGS COPYING ChangeLog NEWS README TODO
%attr(755,root,root) %{_libdir}/libgif.so.*.*.*
-%attr(755,root,root) %ghost %{_libdir}/libgif.so.4
-%attr(755,root,root) %{_libdir}/libungif.so.4
+%ghost %{_libdir}/libgif.so.4
+%{_libdir}/libungif.so.4
%files devel
%defattr(644,root,root,755)
%doc doc/*.txt doc/{gif_lib,intro,liberror}.html
-%attr(755,root,root) %{_libdir}/libgif.so
-%attr(755,root,root) %{_libdir}/libungif.so
+%{_libdir}/libgif.so
+%{_libdir}/libungif.so
%{_libdir}/libgif.la
%{_libdir}/libungif.la
%{_includedir}/gif_lib.h
diff --git a/giflib4-CVE-2015-7555.patch b/giflib4-CVE-2015-7555.patch
new file mode 100644
index 0000000..d1f2dd0
--- /dev/null
+++ b/giflib4-CVE-2015-7555.patch
@@ -0,0 +1,14 @@
+# CVE-2015-7555: giffix writes past its line buffer when an image is wider
+# than the screen.
+# https://sourceforge.net/p/giflib/code/ci/179510be300bf11115e37528d79619b53c884a63
+--- giflib-4.2.3/util/giffix.c
++++ giflib-4.2.3/util/giffix.c
+@@ -116,6 +116,8 @@
+ Height = GifFileIn->Image.Height;
+ GifQprintf("\n%s: Image %d at (%d, %d) [%dx%d]: ",
+ PROGRAM_NAME, ++ImageNum, Col, Row, Width, Height);
++ if (Width > GifFileIn->SWidth)
++ GIF_EXIT("Image is wider than total");
+
+ /* Put the image descriptor to out file: */
+ if (EGifPutImageDesc(GifFileOut, Col, Row, Width, Height,
diff --git a/giflib4-CVE-2026-23868.patch b/giflib4-CVE-2026-23868.patch
new file mode 100644
index 0000000..20eb9ec
--- /dev/null
+++ b/giflib4-CVE-2026-23868.patch
@@ -0,0 +1,74 @@
+# CVE-2026-23868: MakeSavedImage leaves the new image's color map, raster and
+# extension blocks aliasing the source's, so a failed allocation or freeing
+# both images corrupts or double-frees them.
+# https://sourceforge.net/p/giflib/code/ci/f5b7267aed3665ef025c13823e454170d031c106
+# https://sourceforge.net/p/giflib/code/ci/2fab065d3da24d1edf33bb48cb347c64c7aa9e48
+--- giflib-4.2.3/lib/gifalloc.c
++++ giflib-4.2.3/lib/gifalloc.c
+@@ -363,8 +363,16 @@
+ * problems.
+ */
+
++ /* Clear the pointers aliased by the copy above, so that
++ * FreeLastSavedImage does not free CopyFrom's data when an
++ * allocation below fails. */
++ sp->ImageDesc.ColorMap = NULL;
++ sp->RasterBits = NULL;
++ sp->ExtensionBlocks = NULL;
++ sp->ExtensionBlockCount = 0;
++
+ /* first, the local color map */
+- if (sp->ImageDesc.ColorMap) {
++ if (CopyFrom->ImageDesc.ColorMap) {
+ sp->ImageDesc.ColorMap = MakeMapObject(
+ CopyFrom->ImageDesc.ColorMap->ColorCount,
+ CopyFrom->ImageDesc.ColorMap->Colors);
+@@ -387,27 +395,32 @@
+ CopyFrom->ImageDesc.Width);
+
+ /* finally, the extension blocks */
+- if (sp->ExtensionBlocks) {
+- sp->ExtensionBlocks = (ExtensionBlock *)malloc(
+- sizeof(ExtensionBlock) *
+- CopyFrom->ExtensionBlockCount);
++ if (CopyFrom->ExtensionBlocks) {
++ int k;
++
++ sp->ExtensionBlocks = (ExtensionBlock *)calloc(
++ CopyFrom->ExtensionBlockCount,
++ sizeof(ExtensionBlock));
+ if (sp->ExtensionBlocks == NULL) {
+ FreeLastSavedImage(GifFile);
+ return (SavedImage *)(NULL);
+ }
+- memcpy(sp->ExtensionBlocks, CopyFrom->ExtensionBlocks,
+- sizeof(ExtensionBlock) * CopyFrom->ExtensionBlockCount);
++ sp->ExtensionBlockCount = CopyFrom->ExtensionBlockCount;
++ for (k = 0; k < CopyFrom->ExtensionBlockCount; k++) {
++ ExtensionBlock *dst = &sp->ExtensionBlocks[k];
++ ExtensionBlock *src = &CopyFrom->ExtensionBlocks[k];
+
+- /*
+- * For the moment, the actual blocks can take their
+- * chances with free(). We'll fix this later.
+- *** FIXME: [Better check this out... Toshio]
+- * 2004 May 27: Looks like this was an ESR note.
+- * It means the blocks are shallow copied from InFile to
+- * OutFile. However, I don't see that in this code....
+- * Did ESR fix it but never remove this note (And other notes
+- * in gifspnge?)
+- */
++ dst->Function = src->Function;
++ dst->ByteCount = src->ByteCount;
++ if (src->ByteCount > 0) {
++ dst->Bytes = (GifByteType *)malloc(src->ByteCount);
++ if (dst->Bytes == NULL) {
++ FreeLastSavedImage(GifFile);
++ return (SavedImage *)(NULL);
++ }
++ memcpy(dst->Bytes, src->Bytes, src->ByteCount);
++ }
++ }
+ }
+ }
+
diff --git a/giflib4-dgif-bounds.patch b/giflib4-dgif-bounds.patch
new file mode 100644
index 0000000..3bdb0f8
--- /dev/null
+++ b/giflib4-dgif-bounds.patch
@@ -0,0 +1,27 @@
+# CVE-2018-11490: an unchecked LZW RunningCode index lets DGifDecompressLine
+# write past Prefix[] and Suffix[].
+# CVE-2019-15133: DGifSlurp does not reject zero Width/Height.
+# https://sourceforge.net/p/giflib/code/ci/08438a5098f3bb1de23a29334af55eba663f75bd
+# https://sourceforge.net/p/giflib/code/ci/799eb6a3af8a3dd81e2429bf11a72a57e541f908
+--- giflib-4.2.3/lib/dgif_lib.c
++++ giflib-4.2.3/lib/dgif_lib.c
+@@ -831,7 +831,9 @@
+ while (StackPtr != 0 && i < LineLen)
+ Line[i++] = Stack[--StackPtr];
+ }
+- if (LastCode != NO_SUCH_CODE && Prefix[Private->RunningCode - 2] == NO_SUCH_CODE) {
++ if (LastCode != NO_SUCH_CODE &&
++ Private->RunningCode - 2 < LZ_MAX_CODE &&
++ Prefix[Private->RunningCode - 2] == NO_SUCH_CODE) {
+ Prefix[Private->RunningCode - 2] = LastCode;
+
+ if (CrntCode == Private->RunningCode - 2) {
+@@ -1032,7 +1034,7 @@
+
+ sp = &GifFile->SavedImages[GifFile->ImageCount - 1];
+ /* Allocate memory for the image */
+- if (sp->ImageDesc.Width < 0 && sp->ImageDesc.Height < 0 &&
++ if (sp->ImageDesc.Width <= 0 || sp->ImageDesc.Height <= 0 ||
+ sp->ImageDesc.Width > (INT_MAX / sp->ImageDesc.Height)) {
+ return GIF_ERROR;
+ }
diff --git a/giflib4-gif2rgb-bounds.patch b/giflib4-gif2rgb-bounds.patch
new file mode 100644
index 0000000..08f778e
--- /dev/null
+++ b/giflib4-gif2rgb-bounds.patch
@@ -0,0 +1,39 @@
+# gif2rgb's DumpScreen2RGB indexes the color map with unchecked pixel values,
+# reading past its end for images with an out-of-range background or pixel
+# index; free the screen buffer on exit as well.
+# CVE-2016-3977, CVE-2020-23922, CVE-2021-40633, CVE-2022-28506,
+# CVE-2023-48161, CVE-2024-45993, CVE-2025-31344
+# https://sourceforge.net/p/giflib/code/ci/368f28c0034ecfb6dd4b3412af4cc589a56e0611
+# https://sourceforge.net/p/giflib/code/ci/ccbc956432650734c91acb3fc88837f7b81267ff
+# https://sourceforge.net/p/giflib/code/ci/7bbe8ea1a595bb7509ffa0a86b076e9b720e85af
+--- giflib-4.2.3/util/gif2rgb.c
++++ giflib-4.2.3/util/gif2rgb.c
+@@ -210,6 +210,10 @@
+ DumpScreen2RGB(OutFileName, OneFileFlag,
+ ScreenBuffer, GifFile->SWidth, GifFile->SHeight);
+
++ for (i = 0; i < GifFile->SHeight; i++)
++ free((char *) ScreenBuffer[i]);
++ free((char *) ScreenBuffer);
++
+ if (DGifCloseFile(GifFile) == GIF_ERROR) {
+ PrintGifError();
+ exit(EXIT_FAILURE);
+@@ -269,6 +273,8 @@
+ GifRow = ScreenBuffer[i];
+ GifQprintf("\b\b\b\b%-4d", ScreenHeight - i);
+ for (j = 0, BufferP = Buffer; j < ScreenWidth; j++) {
++ if (GifRow[j] >= ColorMap->ColorCount)
++ GIF_EXIT("Color index out of range for colormap");
+ ColorMapEntry = &ColorMap->Colors[GifRow[j]];
+ *BufferP++ = ColorMapEntry->Red;
+ *BufferP++ = ColorMapEntry->Green;
+@@ -292,6 +298,8 @@
+ GifRow = ScreenBuffer[i];
+ GifQprintf("\b\b\b\b%-4d", ScreenHeight - i);
+ for (j = 0; j < ScreenWidth; j++) {
++ if (GifRow[j] >= ColorMap->ColorCount)
++ GIF_EXIT("Color index out of range for colormap");
+ ColorMapEntry = &ColorMap->Colors[GifRow[j]];
+ Buffers[0][j] = ColorMapEntry->Red;
+ Buffers[1][j] = ColorMapEntry->Green;
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/giflib4.git/commitdiff/eb0c7b705b63639f8e870e76de79b5cbc4fe4e0d
More information about the pld-cvs-commit
mailing list