> SplashDecodeGif() uses gif->SBackGroundColor as an index into > colorMap->Colors when handling GIF_DISPOSE_BACKGND. > > The background colour index is read from the GIF Logical Screen Descriptor > and may contain a value from 0 to 255. The value is not validated against > colorMap->ColorCount before indexing the colour table. A malformed GIF with a > small colour table and an out-of-range SBackGroundColor can therefore cause > an out-of-bounds heap read. > > For example, a GIF with a colour table containing two entries and > SBackGroundColor = 255 causes colorMap->Colors[255] to be accessed. The > resulting colour value is subsequently used to fill the disposed frame > background, exposing adjacent heap contents in the rendered splash image. > > Add a bounds check ensuring SBackGroundColor is within ColorCount before > indexing the colour table. > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai).
Timofei Fedotov has updated the pull request incrementally with one additional commit since the last revision: Simplify SplashGifBackgroundColorTest ------------- Changes: - all: https://git.openjdk.org/jdk/pull/33145/files - new: https://git.openjdk.org/jdk/pull/33145/files/4980aed6..d37651fc Webrevs: - full: https://webrevs.openjdk.org/?repo=jdk&pr=33145&range=03 - incr: https://webrevs.openjdk.org/?repo=jdk&pr=33145&range=02-03 Stats: 27 lines in 1 file changed: 8 ins; 8 del; 11 mod Patch: https://git.openjdk.org/jdk/pull/33145.diff Fetch: git fetch https://git.openjdk.org/jdk.git pull/33145/head:pull/33145 PR: https://git.openjdk.org/jdk/pull/33145
