On Wed, 30 Sep 2026 12:18:52 GMT, Timofei Fedotov <[email protected]> wrote:
> SplashDecodeGif() uses gif->SBackGroundColor as an index into > colorMap->Colors when handling GIF_DISPOSE_BACKGND. > > The background colour index is read from the GIF Logical Screen Descriptor > and may contain a value from 0 to 255. The value is not validated against > colorMap->ColorCount before indexing the colour table. A malformed GIF with a > small colour table and an out-of-range SBackGroundColor can therefore cause > an out-of-bounds heap read. > > For example, a GIF with a colour table containing two entries and > SBackGroundColor = 255 causes colorMap->Colors[255] to be accessed. The > resulting colour value is subsequently used to fill the disposed frame > background, exposing adjacent heap contents in the rendered splash image. > > Add a bounds check ensuring SBackGroundColor is within ColorCount before > indexing the colour table. > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai). I think about how to make the test work correctly. Sorry for the long answer. ------------- PR Comment: https://git.openjdk.org/jdk/pull/33145#issuecomment-6288730180
