Skip to content

Use-After-Free bug in gifview (tested with the latest version 1.89)Β #114

Closed
@junxzm1990

Description

@junxzm1990

When viewing a gif figure:

gifread.c:796 gfi = Gif_NewImage(); //https://github.com/kohler/gifsicle/blob/master/src/gifread.c#L796
-> A new object gfi is allocated

gifread.c:826 Gif_AddImage(gfs, gfi)); //https://github.com/kohler/gifsicle/blob/master/src/gifread.c#L826
-> gfi is added into gfs->images (assuming with index 0)
-> gfi->refcount increases by 1

gifread.c:828 read_image(grr, &gfc, gfi, read_flags); //https://github.com/kohler/gifsicle/blob/master/src/gifread.c#L828
-> Try to read the image
-> Assuming this call fails and return 0 (due to a corrupted figure)

gifread.c:829 Gif_RemoveImage(gfs, gfs->nimages - 1); //https://github.com/kohler/gifsicle/blob/master/src/gifread.c#L829
-> Gif_DeleteImage(gfs->images[gfs->nimages - 1])
-> Gif_Delete(gfs->images[gfs->nimages - 1]) (i.e., Gif_Delete(gfi))
-> gfi is freed

gifread.c:830 goto done //https://github.com/kohler/gifsicle/blob/master/src/gifread.c#L830

gifread.c:886-> 893: gfi is used multiple times after being freed. //https://github.com/kohler/gifsicle/blob/master/src/gifread.c#L886

gifread.c:896: gfi is freed again. //https://github.com/kohler/gifsicle/blob/master/src/gifread.c#L896

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions