Recent changes to patches

Comprehensive integer overflow prevention and security hardening

2026-04-06T18:33:52.950000Z

Summary

This patch fixes 4 integer overflow vulnerabilities in giflib's core library and adds security testing infrastructure (sanitizer build targets + libFuzzer harness).

Bug 1: Signed integer overflow in `GifApplyTranslation` (`gifalloc.c:214`)

Height * Width is computed as int (signed 32-bit). For images where the product exceeds INT_MAX, this is undefined behavior per C99 §6.5/5.

UBSan trace on unpatched giflib 6.1.2:

gifalloc.c:214:15: runtime error: signed integer overflow:
46341 * 46341 cannot be represented in type 'int'

The loop bound RasterSize gets an unpredictable value due to UB, corrupting pixel translation. Fixed by using size_t with a new GifSafeMult() overflow-checked multiplication helper.

Bug 2: Heap buffer overflow in `GifMakeSavedImage` (`gifalloc.c:372-384`)

Two independent overflow sites in the same function:

reallocarray(NULL, (Height * Width), sizeof(GifPixelType)) — the Height * Width multiplication happens in int arithmetic before being passed to reallocarray, defeating its overflow protection entirely. The overflowed int is implicitly converted to size_t, producing a wrong allocation size.
memcpy(dst, src, sizeof(GifPixelType) * Height * Width) — computes the copy size independently, also in int arithmetic. The memcpy size does not match the allocation size — on overflow, memcpy writes past the allocated buffer → heap buffer overflow.

Fixed by computing the size once with GifSafeMult() and using it for both allocation and copy. On overflow, the function returns NULL instead of allocating a wrong-sized buffer.

Bug 3: `PixelCount` overflow on 32-bit systems (`dgif_lib.c:418`, `egif_lib.c:451`)

(long)Width * (long)Height overflows signed long on 32-bit platforms where long is 32 bits. For example: 65535 × 65535 = 4,294,836,225 > LONG_MAX (2,147,483,647) on 32-bit.

PixelCount gets a wrong value, causing the decoder/encoder to process the wrong number of pixels. Fixed by casting to size_t and changing the PixelCount field type from unsigned long to size_t.

Note: PixelCount is in GifFilePrivateType (private header gif_lib_private.h), not the public API. Users access it through void *Private in GifFileType. This is not an ABI break.

Bug 4: Unsafe allocation in `quantize.c`

malloc(sizeof(QuantizedColorType *) * NumEntries) replaced with reallocarray(NULL, NumEntries, sizeof(QuantizedColorType *)) for consistent overflow-safe allocation.

Security Infrastructure Added

GifSafeMult() — overflow-checked size_t multiplication helper in gif_lib_private.h
Sanitizer Makefile targets: make check-asan, make check-ubsan, make check-sanitizers
libFuzzer harness: fuzz/gif_fuzz_dgif.c for the DGifSlurp decode path

Testing

All 51 existing tests pass (normal build)
All 51 tests pass under UBSan — zero undefined behavior errors
All 51 tests pass under ASan — zero memory errors
Fuzz harness runs clean at ~5000 exec/s with 165 edge coverage

Files Changed

Makefile             | 18 changes
dgif_lib.c           |  4 changes
egif_lib.c           |  2 changes
gif_lib_private.h    | 15 changes
gifalloc.c           | 41 changes
quantize.c           |  6 changes
fuzz/gif_fuzz_dgif.c | 63 lines (new file)
.gitignore           |  2 lines (new file)

Patch attached. Apply with:

git am giflib-security-hardening.patch

Fix signed integer overflow and memory leak in gifbuild.c

2026-02-18T12:33:09.130000Z

gifbuild.c currently accepts signed integer for Image dimensions, thus negative integers as a result cause a buffer overflow when they are cast to size_t. To prevent this, an integer check is implemented before malloc that checks if dimensions go into negative and if that is the case, the code immediately stops and cleans up any leftover data to prevent data leaks.

Fixes Bug #186

Patch buffer overrun revealed by FORTIFY_SOURCE

2025-05-21T13:27:08.288000Z

During a build of giflib, the below issue was reported at build time. Attached patch should fix the issue based on compiler hints.

giflib: Patch buffer overrun revealed by FORTIFY_SOURCE

--- a/giftext.c 2025-01-09 20:54:01.061791223 +0000
+++ b/giftext.c 2025-01-09 21:04:39.525735979 +0000
@@ -418,7 +418,7 @@
 static void PrintExtBlock(GifByteType *Extension, bool Reset) {
              static int CrntPlace = 0;
              static long ExtCount = 0;
-             static char HexForm[49], AsciiForm[17];
+             static char HexForm[49], AsciiForm[18];

              if (Reset || Extension == NULL) {
                       if (Extension == NULL) {
@@ -464,7 +464,7 @@
 static void PrintPixelBlock(GifByteType *PixelBlock, int Len, bool Reset) {
              static int CrntPlace = 0;
              static long ExtCount = 0;
-             static char HexForm[49], AsciiForm[17];
+             static char HexForm[49], AsciiForm[18];
              int i;

              if (Reset || PixelBlock == NULL) {

#33 Race-Condition on Install

2024-05-29T08:56:14.938000Z

Prio is not 1 but very low. I failed to set it correctly.

Race-Condition on Install

2024-05-29T08:55:03.052000Z

Running make install with -j >1 might cause a race-condition:

install -d "<path>/giflib-build/giflib-5.2.2-install/bin"
install -d "<path>/giflib-build/giflib-5.2.2-install/include"
install -d "<path>/giflib-build/giflib-5.2.2-install/lib"
install: install -m 644 gif_lib.h "<path>/giflib-build/giflib-5.2.2-install/include"
mkdir <path>/giflib-build/giflib-5.2.2-install: File exists
install gif2rgb gifbuild giffix giftext giftool gifclrmp "<path>/giflib-build/giflib-5.2.2-install/bin"
make[1]: *** [install-lib] Error 71
make[1]: *** Waiting for unfinished jobs....

Simplest patch

--- giflib-5.2.2/Makefile.org
+++ giflib-5.2.2/Makefile
@@ -129,6 +129,8 @@

 # Installation/uninstallation

+
+.NOTPARALLEL: install-bin install-include install-lib install-man
 ifeq ($(UNAME), Darwin)
 install: all install-bin install-include install-lib
 else

#31 Wrong position of gif version mark

2024-02-18T19:07:38.810000Z

status: open --> closed

#31 Wrong position of gif version mark

2024-02-18T19:07:25.827000Z

Applied, thanks.

#32 Fix of spoilt image counter

2024-02-18T13:25:04.745000Z

status: open --> closed

#32 Fix of spoilt image counter

2024-02-18T13:24:50.538000Z

Applied, thanks.

#32 Fix of spoilt image counter

2023-10-04T10:14:26.260000Z

Better use this

Recent changes to patches

Comprehensive integer overflow prevention and security hardening

Summary

Bug 1: Signed integer overflow in GifApplyTranslation (gifalloc.c:214)

Bug 2: Heap buffer overflow in GifMakeSavedImage (gifalloc.c:372-384)

Bug 3: PixelCount overflow on 32-bit systems (dgif_lib.c:418, egif_lib.c:451)

Bug 4: Unsafe allocation in quantize.c

Security Infrastructure Added

Testing

Files Changed

Fix signed integer overflow and memory leak in gifbuild.c

Patch buffer overrun revealed by FORTIFY_SOURCE

#33 Race-Condition on Install

Race-Condition on Install

#31 Wrong position of gif version mark

#31 Wrong position of gif version mark

#32 Fix of spoilt image counter

#32 Fix of spoilt image counter

#32 Fix of spoilt image counter

Bug 1: Signed integer overflow in `GifApplyTranslation` (`gifalloc.c:214`)

Bug 2: Heap buffer overflow in `GifMakeSavedImage` (`gifalloc.c:372-384`)

Bug 3: `PixelCount` overflow on 32-bit systems (`dgif_lib.c:418`, `egif_lib.c:451`)

Bug 4: Unsafe allocation in `quantize.c`