From f5b7267aed3665ef025c13823e454170d031c106 Mon Sep 17 00:00:00 2001 From: Eric S. Raymond Date: Wed Mar 4 18:49:49 2026 -0500 Subject: [PATCH] Avoid potentuial double-free on weird images. Upstream-Status: Backport [https://sourceforge.net/p/giflib/code/ci/f5b7267aed3665ef025c13823e454170d031c106] CVE: CVE-2026-23868 Signed-off-by: Vijay Anusuri --- gifalloc.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/gifalloc.c b/gifalloc.c index 47c6539..cfb6e33 100644 --- a/gifalloc.c +++ b/gifalloc.c @@ -349,6 +349,14 @@ SavedImage *GifMakeSavedImage(GifFileType *GifFile, * aliasing problems. */ + /* Null out aliased pointers before any allocations + * so that FreeLastSavedImage won't free CopyFrom's + * data if an allocation fails partway through. */ + sp->ImageDesc.ColorMap = NULL; + sp->RasterBits = NULL; + sp->ExtensionBlocks = NULL; + sp->ExtensionBlockCount = 0; + /* first, the local color map */ if (CopyFrom->ImageDesc.ColorMap != NULL) { sp->ImageDesc.ColorMap = GifMakeMapObject( -- 2.25.1