Skip to content

fix: cast to uint64_t before LZW buffer length calculation - #128

Merged
dloebl merged 1 commit into
mainfrom
fix-lzw-buffer-len-calc
Sep 2, 2026
Merged

fix: cast to uint64_t before LZW buffer length calculation#128
dloebl merged 1 commit into
mainfrom
fix-lzw-buffer-len-calc

Conversation

@dloebl

@dloebl dloebl commented Sep 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

The target for the LZW buffer size is uint64_t, so the calculation has to be done in uint64_t as well - uint32_t isn't sufficient for very large images.

Tested with a 65535x6000 random noise image.

ASAN output:

==12604==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x000117ed4a03 at pc 0x000102e00df4 bp 0x00016d008da0 sp 0x00016d008d98
WRITE of size 1 at 0x000117ed4a03 thread T0
    #0 0x000102e00df0 in create_byte_list+0x4f8 (a.out:arm64+0x10000cdf0)
    #1 0x000102e00068 in LZW_GenerateStream+0x6a0 (a.out:arm64+0x10000c068)
    #2 0x000102dfef00 in cgif_raw_addframe+0x16d8 (a.out:arm64+0x10000af00)
    #3 0x000102df9b94 in flushFrame+0xf14 (a.out:arm64+0x100005b94)
    #4 0x000102dfa494 in cgif_close+0x19c (a.out:arm64+0x100006494)
    #5 0x000102df4dac in main+0x548 (a.out:arm64+0x100000dac)
    #6 0x00018b2f84e0 in start+0x1b4c (dyld:arm64e+0x204e0)

Credits to Ulfar Erlingsson for disclosing this issue to me.

@dloebl dloebl self-assigned this Sep 2, 2026
@dloebl
dloebl requested a review from MCLoebl September 2, 2026 15:29
@dloebl
dloebl merged commit 202d4ab into main Sep 2, 2026
15 checks passed
@dloebl
dloebl deleted the fix-lzw-buffer-len-calc branch September 2, 2026 15:41
This was referenced Sep 2, 2026
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@MCLoebl MCLoebl Awaiting requested review from MCLoebl

Assignees

@dloebl dloebl

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dloebl