413373 - Crash [@nsGIFDecoder2::DoLzw] when loading GIF file

Status: VERIFIED FIXED

(Core :: Graphics: ImageLib, defect, P2)

Description

[Paul Nickerson]

Attachment: Testcase

The attached GIF file crashes the browser in a way that doesn't look exploitable. I hope no-one needs a reduced version, because I wouldn't know how to produce that.

Comment 1

[Paul Nickerson]

Attachment: Stacktrace

Comment 2

[Paul Nickerson]

Also, this doesn't seem to crash branch.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Can't reproduce the crash on Linux/64bit/trunk.
I get
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005: file mozilla/modules/libpr0n/decoders/gif/nsGIFDecoder2.cpp, line 244

Comment 4

[Matthias Versen [:Matti]]

confirming with a 1 day old SM trunk and FF3.0b2 on win32

Comment 5

[Alfred Kayser]

Attachment: Patch to detect malformed LZW encoding

Traced it down to a specific malformed LZW stream issue.
In essence in the input stream there is an illegal code that is outside the valid range. 

Note, Opera can read the image, but all other image tools (that I have) refuse to load it.

The fix is simple: before using 'code' as index in 'suffix' make sure it is within range of 'suffix'. If not, the image has to be considered 'illegal'.

Comment 6

[Reed Loden [:reed]]

Need approval first since this isn't a blocker.

Comment 7

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 298451 [details] [diff] [review]
Patch to detect malformed LZW encoding

a=beltzner for 1.9

Comment 8

[Reed Loden [:reed]]

Checking in modules/libpr0n/decoders/gif/nsGIFDecoder2.cpp;
/cvsroot/mozilla/modules/libpr0n/decoders/gif/nsGIFDecoder2.cpp,v  <--  nsGIFDecoder2.cpp
new revision: 1.93; previous revision: 1.92
done

Comment 9

[Carsten Book [:Tomcat]]

verified fixed using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b4pre) Gecko/2008020819 Minefield/3.0b4pre and the testcase from this bug

- no crash on this testcase -> Verified fixed