Skip to content

Commit

Permalink
libnsgif: Fix null pointer deref on frameless GIF input
Browse files Browse the repository at this point in the history
A crafted GIF file with no frame data could cause a null pointer
dereference leading to denial of service (crash). Reported by
@JieyongMa via huntr.dev.
  • Loading branch information
hpjansson committed Apr 24, 2022
1 parent 8645008 commit e4b777c
Showing 1 changed file with 6 additions and 0 deletions.
6 changes: 6 additions & 0 deletions libnsgif/libnsgif.c
Expand Up @@ -595,6 +595,12 @@ gif_internal_decode_frame(gif_animation *gif,
unsigned int x, y, decode_y, burst_bytes;
register unsigned char colour;

/* If the GIF has no frame data, frame holders will not be allocated in
* gif_initialise() */
if (gif->frames == NULL) {
return GIF_INSUFFICIENT_DATA;
}

/* Ensure this frame is supposed to be decoded */
if (gif->frames[frame].display == false) {
return GIF_OK;
Expand Down

0 comments on commit e4b777c

Please sign in to comment.