Activity for GIFLIB

Michael Cirioli posted a comment on ticket #198

Michael Cirioli — Sun, 11 Oct 2026 14:06:49 -0000

Attached patch fixes the double-free in EGifPutScreenDesc (SF bug #198) while preserving the fix for the EGifSpew leak (SF bug #165). In EGifPutScreenDesc, the pointer-reuse branch added in commit 53d5fcd caused EGifCloseFile to free caller-owned colormaps when passed by reference or assigned to GifFile->SColorMap. The patch: 1. Restores EGifPutScreenDesc to always allocate its own copy of ColorMap via GifMakeMapObject, leaving caller ownership untouched. 2. Handles the EGifSpew cleanup directly...

Adrian Martinez created ticket #210

Adrian Martinez — Sat, 10 Oct 2026 10:17:09 -0000

Double-free in GifMakeSavedImage (sibling of CVE-2026-23868)

Mohmamed Mohamed Elnady modified a comment on ticket #209

Mohmamed Mohamed Elnady — Wed, 30 Sep 2026 21:13:21 -0000

Correction — please use these attachments instead of the earlier 0004–0006. The previously attached patches contained leftover merge-conflict markers in the gifalloc hunks — a commit-tooling error on my side, caught during follow-up work. The corrected series (6 patches, all final-state, no fixup-on-fixup) supersedes them: 0004 (attached): gifalloc memory-safety hardening as one commit with all four fixes and full evidence: (1) stale ImageCount after GifFreeSavedImages() → OOB write in GifMakeSavedImage();...

Mohmamed Mohamed Elnady posted a comment on ticket #209

Mohmamed Mohamed Elnady — Wed, 30 Sep 2026 18:52:04 -0000

Revised attachments (same numbers, updated contents) — posted before you spend time on the originals: • 0008 (tests): as originally written it depended on fixes from the other tickets I'm filing — applied standalone with only this ticket's patches, the quantize/encoder checks would fail and the NULL-callback checks would crash the test binary on unpatched constructors. Trimmed to this ticket's scope (8 checks); the other tickets carry their own test commits (0009/0010/0011), so make check stays green...

Mohmamed Mohamed Elnady created ticket #209

Mohmamed Mohamed Elnady — Wed, 30 Sep 2026 18:25:36 -0000

GifMakeSavedImage: stale ImageCount use-after-free and OOB write in the free/append lifecycle; self-aliased copy UAF; NULL-handling hardening

Jeff Bindel created merge request #28 on Code

Jeff Bindel — Fri, 11 Sep 2026 15:46:13 -0000

decode: add optional -fbounds-safety annotation for ExtensionBlock.Bytes

Sujal Tuladhar created ticket #207

Sujal Tuladhar — Sun, 06 Sep 2026 04:47:21 -0000

gifclrmp -t inverts the translation index at gifclrmp.c:392, producing wrong colours and a heap out-of-bounds write

Darren Carreras created merge request #27 on Code

Darren Carreras — Thu, 03 Sep 2026 15:11:08 -0000

Fix same-file GifMakeSavedImage copies

manan sanghvi created merge request #26 on Code

manan sanghvi — Wed, 02 Sep 2026 04:24:32 -0000

Harden GIF decoding with a memory-safe Rust LZW core

Trithem created merge request #25 on Code

Trithem — Tue, 01 Sep 2026 09:13:47 -0000

Validate decoded GIF color indexes against active color tables

Nexory created ticket #205

Nexory — Fri, 21 Aug 2026 19:51:05 -0000

EGifPutImageDesc: unreachable guard, and writes whose result is discarded

Max van Amersfort created merge request #24 on Code

Max van Amersfort — Fri, 21 Aug 2026 08:00:20 -0000

Enforce GIF color-map invariants

Darren Carreras created merge request #23 on Code

Darren Carreras — Thu, 06 Aug 2026 19:28:56 -0000

Preserve extensions in GifMakeSavedImage copies

Marc Deslauriers created ticket #38

Marc Deslauriers — Tue, 21 Jul 2026 14:59:50 -0000

ExtensionBlockCount is never updated

NGUYEN HOANG HAI created ticket #204

NGUYEN HOANG HAI — Tue, 14 Jul 2026 03:39:27 -0000

Fix integer overflow and (unsigned int) truncation in gif2rgb.c

Andrew Hughes created merge request #22 on Code

Andrew Hughes — Sat, 04 Jul 2026 00:40:45 -0000

Declare correct_saved_images at start of block

Eric S. Raymond committed [a8e311] on Code

Eric S. Raymond — Thu, 11 Jun 2026 10:01:35 -0000

NEWS update.

Eric S. Raymond modified ticket #199

Eric S. Raymond — Thu, 11 Jun 2026 10:00:23 -0000

Buffer Overflow vulnerability in giflib

Eric S. Raymond posted a comment on ticket #199

Eric S. Raymond — Thu, 11 Jun 2026 10:00:23 -0000

Fix applied and pushed

Eric S. Raymond committed [8abe47] on Code

Eric S. Raymond — Wed, 10 Jun 2026 21:00:47 -0000

Resolve ticket #203: GifUnionColorMap NULL Pointer Dereference

Eric S. Raymond committed [4a731e] on Code

Eric S. Raymond — Wed, 10 Jun 2026 20:37:10 -0000

Fix integer overflow and type safety issues across giflib

Eric S. Raymond committed [061605] on Code

Eric S. Raymond — Wed, 10 Jun 2026 20:37:10 -0000

Fix CVE-2026-26740: heap OOB write in EGifGCBToSavedExtension

sidhartha kumar posted a comment on ticket #202

sidhartha kumar — Thu, 04 Jun 2026 17:58:44 -0000

I have successfully created a patch and submitted a Merge Request for this issue here: https://sourceforge.net/p/giflib/code/merge-requests/21/ The patch adds an input validation check at the top of GifQuantizeBuffer() that rejects zero dimensions and dimension pairs whose product would overflow INT_MAX, preventing the heap OOB write.

sidhartha kumar created merge request #21 on Code

sidhartha kumar — Thu, 04 Jun 2026 17:57:00 -0000

Fix integer overflow in GifQuantizeBuffer (CWE-190 → CWE-787)

Michal Hlavinka posted a comment on ticket #201

Michal Hlavinka — Thu, 04 Jun 2026 09:55:59 -0000

This bug report is a duplicate of bug #199 As for the patch, I'm not really sure that silently resizing the buffer is the best approach. It does not match DGifExtensionToGCB which refuses the image and returns error. I think that doing the same - just returning error for invalid data would be better solution.

sidhartha kumar posted a comment on ticket #202

sidhartha kumar — Sun, 17 May 2026 12:27:32 -0000

added the patch.diff attachment couldn't more than one attachment at a time

sidhartha kumar created ticket #202

sidhartha kumar — Sun, 17 May 2026 12:26:07 -0000

Heap buffer overflow in GifQuantizeBuffer via integer overflow

Naveed Khan created ticket #201

Naveed Khan — Fri, 15 May 2026 19:18:59 -0000

Heap buffer overflow in EGifGCBToSavedExtension on malformed Graphics Control Extension

Howetuft modified a comment on discussion Open Discussion

Howetuft — Sun, 26 Apr 2026 16:18:41 -0000

Howetuft posted a comment on discussion Open Discussion

Howetuft — Sun, 26 Apr 2026 16:10:26 -0000

Hello, First, thank you very much for making this lib available to all in open source. However, could you please refrain from frequently changing the structure of the directories where you store sources? Like many developers, I get your sources via a package manager (conan, but could be vcpkg, chocolatey etc. as well) and your changes in the tree constantly break the build recipes.... You did it several times since the beginning of the year, and each time it implies some effort to rebuild the recipes,...

Michal Hlavinka posted a comment on ticket #199

Michal Hlavinka — Tue, 21 Apr 2026 20:46:51 -0000

I can confirm that with provided poc.gif the problem can be reproduced by running giftool with valgrind: ==56559== Invalid write of size 1 ==56559== at 0x488933B: EGifGCBToExtension (in /usr/lib64/libgif.so.7.1.0) ==56559== by 0x488D93A: EGifGCBToSavedExtension (in /usr/lib64/libgif.so.7.1.0) ==56559== by 0x4000F03: ??? (in /usr/bin/giftool) ==56559== by 0x48985B4: (below main) (libc_start_call_main.h:58) ... I've added a fix to my build - same check as is in the reverse function DGifExtensionToGCB...

Gayathri Venkat created ticket #199

Gayathri Venkat — Tue, 21 Apr 2026 06:18:02 -0000

Buffer Overflow vulnerability in giflib

Scott Kidder created ticket #198

Scott Kidder — Mon, 20 Apr 2026 17:28:10 -0000

EGifPutScreenDesc pointer-reuse optimization causes double-free

GIFLIB released /giflib-6.x/giflib-6.1.3.tar.gz

GIFLIB — Sun, 12 Apr 2026 17:23:02 -0000

Eric S. Raymond committed [edff4a] on Code

Eric S. Raymond — Sun, 12 Apr 2026 17:18:15 -0000

Ready to ship 6.1.3

Eric S. Raymond committed [1a56c7] on Code

Eric S. Raymond — Sun, 12 Apr 2026 17:18:15 -0000

Prepare for release.

Eric S. Raymond modified a comment on ticket #189

Eric S. Raymond — Sun, 12 Apr 2026 17:09:48 -0000

No, the real problem is you have a crappy single-pass linker. The library builds just fine on systems without broken toolchains.

Eric S. Raymond posted a comment on ticket #189

Eric S. Raymond — Sun, 12 Apr 2026 17:09:35 -0000

No, the real problem is you have a crappy single-pass linker. The library builds just fine on systems without brokenm toolchains.

Eric S. Raymond committed [c2585d] on Code

Eric S. Raymond — Sat, 11 Apr 2026 21:21:18 -0000

Avoid a dodgy edge case in reallocarry().

Eric S. Raymond modified ticket #197

Eric S. Raymond — Sat, 11 Apr 2026 21:08:15 -0000

Global-buffer-overflow (OOB read) in GifDrawText8x8

Eric S. Raymond posted a comment on ticket #197

Eric S. Raymond — Sat, 11 Apr 2026 21:08:15 -0000

I've added full bounds checking and clipping on all entry points in gif_font.c

Eric S. Raymond modified ticket #196

Eric S. Raymond — Sat, 11 Apr 2026 21:07:04 -0000

Heap-buffer-overflow (OOB write) in GifDrawText8x8

Eric S. Raymond posted a comment on ticket #196

Eric S. Raymond — Sat, 11 Apr 2026 21:07:04 -0000

I've added full bounds checking and clipping on all entry points in gif_font.c

Eric S. Raymond modified ticket #195

Eric S. Raymond — Sat, 11 Apr 2026 21:06:37 -0000

Heap-buffer-overflow (OOB write) in GifDrawRectangle

Eric S. Raymond posted a comment on ticket #195

Eric S. Raymond — Sat, 11 Apr 2026 21:06:37 -0000

I've added full bounds checking and clipping on all entry points in gif_font.c

Eric S. Raymond modified ticket #194

Eric S. Raymond — Sat, 11 Apr 2026 21:05:12 -0000

heap-buffer-overflow (OOB write) in GifDrawBox

Eric S. Raymond posted a comment on ticket #194

Eric S. Raymond — Sat, 11 Apr 2026 21:04:57 -0000

I've added full bounds checking and clipping on all entrry points in gif_font.c

Eric S. Raymond committed [9c2254] on Code

Eric S. Raymond — Sat, 11 Apr 2026 21:04:18 -0000

Add full bounds-checking and clipping on all gif_font.c operations.

Eric S. Raymond committed [d0d160] on Code

Eric S. Raymond — Sat, 11 Apr 2026 20:39:37 -0000

Address GifLib bug #192: Heap buffer overflow in GifUnionColorMap...

Eric S. Raymond modified ticket #190

Eric S. Raymond — Sat, 11 Apr 2026 20:34:14 -0000

missing 6.1.1 tarball

Eric S. Raymond modified a comment on ticket #190

Eric S. Raymond — Sat, 11 Apr 2026 20:34:00 -0000

Not that I know of. But this is only going to happen on majorversion bumps, and there have only been three of those in 40 years.

Eric S. Raymond modified ticket #191

Eric S. Raymond — Sat, 11 Apr 2026 20:32:50 -0000

Fix integer overflows, out-of-bounds access, and uninitialized memory

Eric S. Raymond modified ticket #191

Eric S. Raymond — Sat, 11 Apr 2026 20:32:28 -0000

Fix integer overflows, out-of-bounds access, and uninitialized memory

Eric S. Raymond posted a comment on ticket #191

Eric S. Raymond — Sat, 11 Apr 2026 20:32:28 -0000

This is not a patch for giflib. Can't apply, rejected.

Eric S. Raymond posted a comment on ticket #190

Eric S. Raymond — Sat, 11 Apr 2026 20:27:51 -0000

Not that I know of. But this is only going to happwn of majoe version bumps, and there have only been three of those in 40 years.

Mohammad Seet created ticket #37

Mohammad Seet — Mon, 06 Apr 2026 18:33:54 -0000

Comprehensive integer overflow prevention and security hardening

Biniam D created ticket #197

Biniam D — Fri, 03 Apr 2026 12:34:59 -0000

Global-buffer-overflow (OOB read) in GifDrawText8x8

Biniam D created ticket #196

Biniam D — Fri, 03 Apr 2026 12:33:03 -0000

Heap-buffer-overflow (OOB write) in GifDrawText8x8

Biniam D created ticket #195

Biniam D — Fri, 03 Apr 2026 12:25:57 -0000

Heap-buffer-overflow (OOB write) in GifDrawRectangle

Biniam D created ticket #194

Biniam D — Fri, 03 Apr 2026 12:21:45 -0000

heap-buffer-overflow (OOB write) in GifDrawBox

joborun linux modified a comment on discussion Help

joborun linux — Wed, 01 Apr 2026 09:21:56 -0000

make install does not include the gif2rgb for bin doc man as it used to although the files are built I had to manually add them

joborun linux posted a comment on discussion Help

joborun linux — Wed, 01 Apr 2026 09:21:41 -0000

make install does not include the gif2rgb for bin doc man as it used to although the files are built I had to manually add them

Ildar Mulyukov posted a comment on ticket #191

Ildar Mulyukov — Sun, 22 Mar 2026 20:49:35 -0000

the patch is very strange. Could you please clarify how is it supposed to be applied? Note: it patches files like vp8/encoder/onyx_if.c

Michael Cho posted a comment on ticket #189

Michael Cho — Fri, 13 Mar 2026 14:04:47 -0000

As another data point, in Homebrew we also saw undefined symbols error in 6.1.2 release. This is specific to macOS builds and can be reproduced with a make all in a fresh download of release tarball. Or isolated to specific problem target via make libutil.dylib, e.g. ❯ curl https://downloads.sourceforge.net/project/giflib/giflib-6.x/giflib-6.1.2.tar.gz -sL | tar x ❯ make -C giflib-6.1.2 libutil.dylib cc -std=gnu99 -fPIC -Wall -O2 -c -o qprintf.o qprintf.c cc -std=gnu99 -fPIC -Wall -O2 -c -o getarg.o...

pandablackhole created ticket #191

pandablackhole — Thu, 12 Mar 2026 06:13:46 -0000

Fix integer overflows, out-of-bounds access, and uninitialized memory

Dominic Lüchinger posted a comment on ticket #190

Dominic Lüchinger — Wed, 11 Mar 2026 15:52:57 -0000

Our build system relies on conan downloading the giflib dependency from https://downloads.sourceforge.net/project/giflib/giflib-5.2.1.tar.gz It seems the file where moved and now the conan https://github.com/conan-io/conan-center-index/blob/29a66c9c0d881651cab2573a4e63ad6e57cddc7f/recipes/giflib/5.2.x/conandata.yml points to the wrong location. Maybe other package managers or other build system might have similar issue. Is there a way to instruct sourceforge that the location was moved and will do...

Thomas Klausner posted a comment on ticket #190

Thomas Klausner — Tue, 10 Mar 2026 20:42:00 -0000

Thanks, looks good now!

GIFLIB released /giflib-5.x/giflib-5.2.2.tar.gz