commit f5b7267aed3665ef025c13823e454170d031c106 Author: Eric S. Raymond Date: Wed Mar 4 18:49:49 2026 -0500 Avoid potentuial double-free on weird images. CVE: CVE-2026-23868 Upstream: https://sourceforge.net/p/giflib/code/ci/f5b7267aed3665ef025c13823e454170d031c106 Signed-off-by: Thomas Perale diff --git a/gifalloc.c b/gifalloc.c index 01a845d..ff70cb0 100644 --- a/gifalloc.c +++ b/gifalloc.c @@ -349,6 +349,14 @@ SavedImage *GifMakeSavedImage(GifFileType *GifFile, * aliasing problems. */ + /* Null out aliased pointers before any allocations + * so that FreeLastSavedImage won't free CopyFrom's + * data if an allocation fails partway through. */ + sp->ImageDesc.ColorMap = NULL; + sp->RasterBits = NULL; + sp->ExtensionBlocks = NULL; + sp->ExtensionBlockCount = 0; + /* first, the local color map */ if (CopyFrom->ImageDesc.ColorMap != NULL) { sp->ImageDesc.ColorMap = GifMakeMapObject(