jinny opened issue #2: gif2png crashes (null pointer dereference) with malformated gif input at Eric S. Raymond / gif2png

jinny
2018-10-16T05:37:06Z

Hi,

We found a NULL pointer dereference affecting gif2png-2.5.11 with a gif file, which allows a denial-of-service attack.

We are attaching a gif file.

$ ./gif2png crash.gif
gif2png: bad version number, not '87a' or '89a', trying anyway
gif2png: circular table STACK OVERFLOW!
gif2png: circular table STACK OVERFLOW!
gif2png: circular table STACK OVERFLOW!
gif2png: circular table STACK OVERFLOW!
gif2png: 253 unused colors; convert with -O to remove
Segmentation fault (core dumped)

$ ./gif2png crash.gif
gif2png: bad version number, not '87a' or '89a', trying anyway
gif2png: circular table STACK OVERFLOW!
gif2png: circular table STACK OVERFLOW!
gif2png: circular table STACK OVERFLOW!
gif2png: circular table STACK OVERFLOW!
gif2png: 253 unused colors; convert with -O to remove
ASAN:SIGSEGV
=================================================================
==21933== ERROR: AddressSanitizer: SEGV on unknown address 0x00000000 (pc 0xb5ff99c6 sp 0xbf814824 bp 0xbf814878 T0)
AddressSanitizer can not provide additional info.
#0 0xb5ff99c5 (/lib/i386-linux-gnu/libc-2.19.so+0x839c5)
#1 0xb615cc7e (/usr/lib/i386-linux-gnu/libasan.so.0.0.0+0xec7e)
#2 0x804ba90 (/gif2png-2.5.11/gif2png+0x804ba90)
#3 0x804d818 (/gif2png-2.5.11/gif2png+0x804d818)
#4 0x80499ef (/gif2png-2.5.11/gif2png+0x80499ef)
#5 0xb5f8fa82 (/lib/i386-linux-gnu/libc-2.19.so+0x19a82)
#6 0x804a030 (/gif2png-2.5.11/gif2png+0x804a030)
==21933== ABORTING