Recent changes to patches

Comprehensive integer overflow prevention and security hardening

Mohammad Seet — Mon, 06 Apr 2026 18:33:52 -0000

Summary

This patch fixes 4 integer overflow vulnerabilities in giflib's core library and adds security testing infrastructure (sanitizer build targets + libFuzzer harness).

Bug 1: Signed integer overflow in `GifApplyTranslation` (`gifalloc.c:214`)

Height * Width is computed as int (signed 32-bit). For images where the product exceeds INT_MAX, this is undefined behavior per C99 §6.5/5.

UBSan trace on unpatched giflib 6.1.2:

gifalloc.c:214:15: runtime error: signed integer overflow:
46341 * 46341 cannot be represented in type 'int'

The loop bound RasterSize gets an unpredictable value due to UB, corrupting pixel translation. Fixed by using size_t with a new GifSafeMult() overflow-checked multiplication helper.

Bug 2: Heap buffer overflow in `GifMakeSavedImage` (`gifalloc.c:372-384`)

Two independent overflow sites in the same function:

reallocarray(NULL, (Height * Width), sizeof(GifPixelType)) — the Height * Width multiplication happens in int arithmetic before being passed to reallocarray, defeating its overflow protection entirely. The overflowed int is implicitly converted to size_t, producing a wrong allocation size.
memcpy(dst, src, sizeof(GifPixelType) * Height * Width) — computes the copy size independently, also in int arithmetic. The memcpy size does not match the allocation size — on overflow, memcpy writes past the allocated buffer → heap buffer overflow.

Fixed by computing the size once with GifSafeMult() and using it for both allocation and copy. On overflow, the function returns NULL instead of allocating a wrong-sized buffer.

Bug 3: `PixelCount` overflow on 32-bit systems (`dgif_lib.c:418`, `egif_lib.c:451`)

(long)Width * (long)Height overflows signed long on 32-bit platforms where long is 32 bits. For example: 65535 × 65535 = 4,294,836,225 > LONG_MAX (2,147,483,647) on 32-bit.

PixelCount gets a wrong value, causing the decoder/encoder to process the wrong number of pixels. Fixed by casting to size_t and changing the PixelCount field type from unsigned long to size_t.

Note: PixelCount is in GifFilePrivateType (private header gif_lib_private.h), not the public API. Users access it through void *Private in GifFileType. This is not an ABI break.

Bug 4: Unsafe allocation in `quantize.c`

malloc(sizeof(QuantizedColorType *) * NumEntries) replaced with reallocarray(NULL, NumEntries, sizeof(QuantizedColorType *)) for consistent overflow-safe allocation.

Security Infrastructure Added

GifSafeMult() — overflow-checked size_t multiplication helper in gif_lib_private.h
Sanitizer Makefile targets: make check-asan, make check-ubsan, make check-sanitizers
libFuzzer harness: fuzz/gif_fuzz_dgif.c for the DGifSlurp decode path

Testing

All 51 existing tests pass (normal build)
All 51 tests pass under UBSan — zero undefined behavior errors
All 51 tests pass under ASan — zero memory errors
Fuzz harness runs clean at ~5000 exec/s with 165 edge coverage

Files Changed

Makefile             | 18 changes
dgif_lib.c           |  4 changes
egif_lib.c           |  2 changes
gif_lib_private.h    | 15 changes
gifalloc.c           | 41 changes
quantize.c           |  6 changes
fuzz/gif_fuzz_dgif.c | 63 lines (new file)
.gitignore           |  2 lines (new file)

Patch attached. Apply with:

git am giflib-security-hardening.patch

Fix signed integer overflow and memory leak in gifbuild.c

Jeffin Philip — Wed, 18 Feb 2026 12:33:09 -0000

gifbuild.c currently accepts signed integer for Image dimensions, thus negative integers as a result cause a buffer overflow when they are cast to size_t. To prevent this, an integer check is implemented before malloc that checks if dimensions go into negative and if that is the case, the code immediately stops and cleans up any leftover data to prevent data leaks.

Fixes Bug #186

Patch buffer overrun revealed by FORTIFY_SOURCE

Ritesh Raj Sarraf — Wed, 21 May 2025 13:27:08 -0000

During a build of giflib, the below issue was reported at build time. Attached patch should fix the issue based on compiler hints.

giflib: Patch buffer overrun revealed by FORTIFY_SOURCE

--- a/giftext.c 2025-01-09 20:54:01.061791223 +0000
+++ b/giftext.c 2025-01-09 21:04:39.525735979 +0000
@@ -418,7 +418,7 @@
 static void PrintExtBlock(GifByteType *Extension, bool Reset) {
              static int CrntPlace = 0;
              static long ExtCount = 0;
-             static char HexForm[49], AsciiForm[17];
+             static char HexForm[49], AsciiForm[18];

              if (Reset || Extension == NULL) {
                       if (Extension == NULL) {
@@ -464,7 +464,7 @@
 static void PrintPixelBlock(GifByteType *PixelBlock, int Len, bool Reset) {
              static int CrntPlace = 0;
              static long ExtCount = 0;
-             static char HexForm[49], AsciiForm[17];
+             static char HexForm[49], AsciiForm[18];
              int i;

              if (Reset || PixelBlock == NULL) {

#33 Race-Condition on Install

Sebastian Koerner — Wed, 29 May 2024 08:56:14 -0000

Prio is not 1 but very low. I failed to set it correctly.

Race-Condition on Install

Sebastian Koerner — Wed, 29 May 2024 08:55:03 -0000

Running make install with -j >1 might cause a race-condition:

install -d "<path>/giflib-build/giflib-5.2.2-install/bin"
install -d "<path>/giflib-build/giflib-5.2.2-install/include"
install -d "<path>/giflib-build/giflib-5.2.2-install/lib"
install: install -m 644 gif_lib.h "<path>/giflib-build/giflib-5.2.2-install/include"
mkdir <path>/giflib-build/giflib-5.2.2-install: File exists
install gif2rgb gifbuild giffix giftext giftool gifclrmp "<path>/giflib-build/giflib-5.2.2-install/bin"
make[1]: *** [install-lib] Error 71
make[1]: *** Waiting for unfinished jobs....

Simplest patch

--- giflib-5.2.2/Makefile.org
+++ giflib-5.2.2/Makefile
@@ -129,6 +129,8 @@

 # Installation/uninstallation

+
+.NOTPARALLEL: install-bin install-include install-lib install-man
 ifeq ($(UNAME), Darwin)
 install: all install-bin install-include install-lib
 else

#31 Wrong position of gif version mark

Eric S. Raymond — Sun, 18 Feb 2024 19:07:38 -0000

status: open --> closed

#31 Wrong position of gif version mark

Eric S. Raymond — Sun, 18 Feb 2024 19:07:25 -0000

Applied, thanks.

#32 Fix of spoilt image counter

Eric S. Raymond — Sun, 18 Feb 2024 13:25:04 -0000

status: open --> closed

#32 Fix of spoilt image counter

Eric S. Raymond — Sun, 18 Feb 2024 13:24:50 -0000

Applied, thanks.

#32 Fix of spoilt image counter

Kobrin Eli — Wed, 04 Oct 2023 10:14:26 -0000

Better use this

Recent changes to patches

Comprehensive integer overflow prevention and security hardening

Summary

Bug 1: Signed integer overflow in GifApplyTranslation (gifalloc.c:214)

Bug 2: Heap buffer overflow in GifMakeSavedImage (gifalloc.c:372-384)

Bug 3: PixelCount overflow on 32-bit systems (dgif_lib.c:418, egif_lib.c:451)

Bug 4: Unsafe allocation in quantize.c

Security Infrastructure Added

Testing

Files Changed

Fix signed integer overflow and memory leak in gifbuild.c

Patch buffer overrun revealed by FORTIFY_SOURCE

#33 Race-Condition on Install

Race-Condition on Install

#31 Wrong position of gif version mark

#31 Wrong position of gif version mark

#32 Fix of spoilt image counter

#32 Fix of spoilt image counter

#32 Fix of spoilt image counter

Bug 1: Signed integer overflow in `GifApplyTranslation` (`gifalloc.c:214`)

Bug 2: Heap buffer overflow in `GifMakeSavedImage` (`gifalloc.c:372-384`)

Bug 3: `PixelCount` overflow on 32-bit systems (`dgif_lib.c:418`, `egif_lib.c:451`)

Bug 4: Unsafe allocation in `quantize.c`