On Wed, 30 Sep 2026 12:18:52 GMT, Timofei Fedotov <[email protected]> wrote:
> SplashDecodeGif() uses gif->SBackGroundColor as an index into > colorMap->Colors when handling GIF_DISPOSE_BACKGND. > > The background colour index is read from the GIF Logical Screen Descriptor > and may contain a value from 0 to 255. The value is not validated against > colorMap->ColorCount before indexing the colour table. A malformed GIF with a > small colour table and an out-of-range SBackGroundColor can therefore cause > an out-of-bounds heap read. > > For example, a GIF with a colour table containing two entries and > SBackGroundColor = 255 causes colorMap->Colors[255] to be accessed. The > resulting colour value is subsequently used to fill the disposed frame > background, exposing adjacent heap contents in the rendered splash image. > > Add a bounds check ensuring SBackGroundColor is within ColorCount before > indexing the colour table. > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai). This pull request has now been integrated. Changeset: 73aa91b5 Author: Timofei Fedotov <[email protected]> Committer: Artem Semenov <[email protected]> URL: https://git.openjdk.org/jdk/commit/73aa91b52016b37b89900d7d7ace5433a084af2a Stats: 116 lines in 2 files changed: 115 ins; 0 del; 1 mod 8393264: SplashDecodeGif may read past GIF colour table Reviewed-by: prr, asemenov ------------- PR: https://git.openjdk.org/jdk/pull/33145
