On Tue, 20 Oct 2026 10:20:52 GMT, Timofei Fedotov <[email protected]> wrote:
>> SplashDecodeGif() uses gif->SBackGroundColor as an index into >> colorMap->Colors when handling GIF_DISPOSE_BACKGND. >> >> The background colour index is read from the GIF Logical Screen Descriptor >> and may contain a value from 0 to 255. The value is not validated against >> colorMap->ColorCount before indexing the colour table. A malformed GIF with >> a small colour table and an out-of-range SBackGroundColor can therefore >> cause an out-of-bounds heap read. >> >> For example, a GIF with a colour table containing two entries and >> SBackGroundColor = 255 causes colorMap->Colors[255] to be accessed. The >> resulting colour value is subsequently used to fill the disposed frame >> background, exposing adjacent heap contents in the rendered splash image. >> >> Add a bounds check ensuring SBackGroundColor is within ColorCount before >> indexing the colour table. >> >> --------- >> - [x] I confirm that I make this contribution in accordance with the >> [OpenJDK Interim AI Policy](https://openjdk.org/legal/ai). > > Timofei Fedotov has updated the pull request incrementally with one > additional commit since the last revision: > > Add test test/jdk/java/awt/SplashScreen/SplashGifBackgroundColorTest.java line 96: > 94: > .redirectErrorStream(true).redirectOutput(out.toFile()); > 95: > 96: String display = display(); I should have noticed all this stuff earlier. The headful keyword is all you need. It is our way of making sure the test is run in the right environment. So you can get different of display() etc. Also the isWindows should not be needed "java" should work as well as "java.exe". ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/33145#discussion_r4394117498
