[2017-04-13 16:34 UTC] admin at replay dot gg

Description:
------------
The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c (which can be reached with a call to the imagecreatefromstring() function) uses constant-sized color tables of size 3 * 256, but does not zero-out these arrays before use.

An attacker could craft a GIF image with the smallest global color table of size 2, but have color data which indexes the max 256 possibly distinct colors. As a result, the decoded image will contain pixels who's RGB colors will represent whatever data was in the 762 non-initialized bytes from the color table (ColorMap array), which is on the stack.

If the image is then saved and can be accessed, the attacker can use the RGB values of the pixels in the image to read 762 bytes that were on the stack at the time the image was parsed. This could cause sensitive server data such as private keys to be read by the attacker.

If the decoded image is saved in a lossless PNG format, byte-perfect data recovery is trivial. If the decoded image is saved in the JPEG format with the standard 8x8 block DCT, the attacker could craft a GIF image with 16x16 solid-color blocks (to account for CbCr channel down-sampling) which would preserve the pixel data through the quantization process, and again allow for byte-perfect data recovery. 

Currently all websites and applications that rely on PHP's imagecreatefromstring() or imagecreatefromgif() function to decode and save GIF images are vulnerable to this bug.

The appropriate solution is to zero both ColorMap and localColorMap arrays before use.

This bug has been confirmed by the current maintainers of the official LibGD branch.

-----
Matviy Kotoniy

Test script:
---------------
GIF file with color table size set to 0 in the descriptor, and image data which indexes 256 different colors in the color table.

Expected result:
----------------
Error, or solid color for invalid color indexes

Actual result:
--------------
RGB color data representing ~700 bytes of uninitialized data above the current stack frame. http://i.imgur.com/OsT7HFP.jpg