> SplashDecodeGif() uses gif->SBackGroundColor as an index into > colorMap->Colors when handling GIF_DISPOSE_BACKGND. > > The background colour index is read from the GIF Logical Screen Descriptor > and may contain a value from 0 to 255. The value is not validated against > colorMap->ColorCount before indexing the colour table. A malformed GIF with a > small colour table and an out-of-range SBackGroundColor can therefore cause > an out-of-bounds heap read. > > For example, a GIF with a colour table containing two entries and > SBackGroundColor = 255 causes colorMap->Colors[255] to be accessed. The > resulting colour value is subsequently used to fill the disposed frame > background, exposing adjacent heap contents in the rendered splash image. > > Add a bounds check ensuring SBackGroundColor is within ColorCount before > indexing the colour table. > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai).
Timofei Fedotov has updated the pull request incrementally with one additional commit since the last revision: Add test ------------- Changes: - all: https://git.openjdk.org/jdk/pull/33145/files - new: https://git.openjdk.org/jdk/pull/33145/files/5134d745..0c23bc8d Webrevs: - full: https://webrevs.openjdk.org/?repo=jdk&pr=33145&range=01 - incr: https://webrevs.openjdk.org/?repo=jdk&pr=33145&range=00-01 Stats: 178 lines in 1 file changed: 178 ins; 0 del; 0 mod Patch: https://git.openjdk.org/jdk/pull/33145.diff Fetch: git fetch https://git.openjdk.org/jdk.git pull/33145/head:pull/33145 PR: https://git.openjdk.org/jdk/pull/33145
