On Wed, 28 Oct 2026 06:31:10 GMT, Timofei Fedotov <[email protected]> wrote:
>> SplashDecodeGif() uses gif->SBackGroundColor as an index into >> colorMap->Colors when handling GIF_DISPOSE_BACKGND. >> >> The background colour index is read from the GIF Logical Screen Descriptor >> and may contain a value from 0 to 255. The value is not validated against >> colorMap->ColorCount before indexing the colour table. A malformed GIF with >> a small colour table and an out-of-range SBackGroundColor can therefore >> cause an out-of-bounds heap read. >> >> For example, a GIF with a colour table containing two entries and >> SBackGroundColor = 255 causes colorMap->Colors[255] to be accessed. The >> resulting colour value is subsequently used to fill the disposed frame >> background, exposing adjacent heap contents in the rendered splash image. >> >> Add a bounds check ensuring SBackGroundColor is within ColorCount before >> indexing the colour table. >> >> --------- >> - [x] I confirm that I make this contribution in accordance with the >> [OpenJDK Interim AI Policy](https://openjdk.org/legal/ai). > > Timofei Fedotov has updated the pull request incrementally with one > additional commit since the last revision: > > Simplify SplashGifBackgroundColorTest test/jdk/java/awt/SplashScreen/SplashGifBackgroundColorTest.java line 9: > 7: * published by the Free Software Foundation. Oracle designates this > 8: * particular file as subject to the "Classpath" exception as provided > 9: * by Oracle in the LICENSE file that accompanied this code. It looks you've got copied the header from a src file rather than a test file. ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/33145#discussion_r4410048103
