From af4a395c43663c0947566515af4e90db131df381 Mon Sep 17 00:00:00 2001 From: Saikari Date: Tue, 4 Aug 2026 15:12:31 +0300 Subject: [PATCH 1/9] Add gifdec port with initial configuration and test setup --- ports/gifdec/CMakeLists.txt | 32 +++++++++++++++++++ ports/gifdec/portfile.cmake | 23 +++++++++++++ .../gifdec/unofficial-gifdec-config.cmake.in | 3 ++ ports/gifdec/vcpkg.json | 17 ++++++++++ .../test_ports/vcpkg-ci-gifdec/portfile.cmake | 5 +++ .../vcpkg-ci-gifdec/project/CMakeLists.txt | 5 +++ .../test_ports/vcpkg-ci-gifdec/project/main.c | 8 +++++ scripts/test_ports/vcpkg-ci-gifdec/vcpkg.json | 12 +++++++ versions/baseline.json | 4 +++ versions/g-/gifdec.json | 9 ++++++ 10 files changed, 118 insertions(+) create mode 100644 ports/gifdec/CMakeLists.txt create mode 100644 ports/gifdec/portfile.cmake create mode 100644 ports/gifdec/unofficial-gifdec-config.cmake.in create mode 100644 ports/gifdec/vcpkg.json create mode 100644 scripts/test_ports/vcpkg-ci-gifdec/portfile.cmake create mode 100644 scripts/test_ports/vcpkg-ci-gifdec/project/CMakeLists.txt create mode 100644 scripts/test_ports/vcpkg-ci-gifdec/project/main.c create mode 100644 scripts/test_ports/vcpkg-ci-gifdec/vcpkg.json create mode 100644 versions/g-/gifdec.json diff --git a/ports/gifdec/CMakeLists.txt b/ports/gifdec/CMakeLists.txt new file mode 100644 index 00000000000000..4c4a46fb731a9c --- /dev/null +++ b/ports/gifdec/CMakeLists.txt @@ -0,0 +1,32 @@ +cmake_minimum_required(VERSION 3.15) +project(gifdec LANGUAGES C) + +add_library(gifdec gifdec.c) +target_include_directories(gifdec PUBLIC + "$" + "$") + +install(TARGETS gifdec + EXPORT gifdec_targets + ARCHIVE DESTINATION lib + LIBRARY DESTINATION lib + RUNTIME DESTINATION bin +) +install(FILES gifdec.h DESTINATION include) + +include(CMakePackageConfigHelpers) +set(PACKAGE_CONFIG_FILE "${CMAKE_CURRENT_BINARY_DIR}/unofficial-gifdec-config.cmake") +set(INSTALL_CONFIG_DIR "${CMAKE_INSTALL_LIBDIR}/cmake/unofficial-gifdec") + +configure_package_config_file(unofficial-gifdec-config.cmake.in + "${PACKAGE_CONFIG_FILE}" + INSTALL_DESTINATION "${INSTALL_CONFIG_DIR}" +) + +install(EXPORT gifdec_targets + NAMESPACE unofficial::gifdec:: + FILE unofficial-gifdec-targets.cmake + DESTINATION "${INSTALL_CONFIG_DIR}" +) + +install(FILES "${PACKAGE_CONFIG_FILE}" DESTINATION "${INSTALL_CONFIG_DIR}") diff --git a/ports/gifdec/portfile.cmake b/ports/gifdec/portfile.cmake new file mode 100644 index 00000000000000..2e89558c654b9e --- /dev/null +++ b/ports/gifdec/portfile.cmake @@ -0,0 +1,23 @@ +vcpkg_from_github( + OUT_SOURCE_PATH SOURCE_PATH + REPO lecram/gifdec + REF 1dcbae19363597314f6623010cc80abad4e47f7c + SHA512 2756004cb7dd8be5560a32c188001da503b97f1b8e3eed908787563b7e36edf8cbca3605e2e75b2ebbc69b329e16d89b3237028dfd7a772d2763bf78b1675ad2 + HEAD_REF master +) + +file(COPY + "${CMAKE_CURRENT_LIST_DIR}/CMakeLists.txt" + "${CMAKE_CURRENT_LIST_DIR}/unofficial-gifdec-config.cmake.in" + DESTINATION "${SOURCE_PATH}" +) + +vcpkg_cmake_configure( + SOURCE_PATH "${SOURCE_PATH}" +) + +vcpkg_cmake_install() +vcpkg_cmake_config_fixup(PACKAGE_NAME unofficial-gifdec CONFIG_PATH lib/cmake/unofficial-gifdec) + +file(WRITE "${SOURCE_PATH}/LICENSE" [[gifdec is released into the public domain, as stated in its README file.]]) +vcpkg_install_copyright(FILE_LIST "${SOURCE_PATH}/LICENSE") diff --git a/ports/gifdec/unofficial-gifdec-config.cmake.in b/ports/gifdec/unofficial-gifdec-config.cmake.in new file mode 100644 index 00000000000000..c0b32adb33ebdd --- /dev/null +++ b/ports/gifdec/unofficial-gifdec-config.cmake.in @@ -0,0 +1,3 @@ +@PACKAGE_INIT@ +include("${CMAKE_CURRENT_LIST_DIR}/unofficial-gifdec-targets.cmake") +check_required_components("gifdec") diff --git a/ports/gifdec/vcpkg.json b/ports/gifdec/vcpkg.json new file mode 100644 index 00000000000000..a22d553304b837 --- /dev/null +++ b/ports/gifdec/vcpkg.json @@ -0,0 +1,17 @@ +{ + "name": "gifdec", + "version-date": "2021-12-04", + "description": "Small C library for reading GIF files", + "homepage": "https://github.com/lecram/gifdec", + "license": "LicenseRef-Public-Domain", + "dependencies": [ + { + "name": "vcpkg-cmake", + "host": true + }, + { + "name": "vcpkg-cmake-config", + "host": true + } + ] +} diff --git a/scripts/test_ports/vcpkg-ci-gifdec/portfile.cmake b/scripts/test_ports/vcpkg-ci-gifdec/portfile.cmake new file mode 100644 index 00000000000000..8a2079b2178d36 --- /dev/null +++ b/scripts/test_ports/vcpkg-ci-gifdec/portfile.cmake @@ -0,0 +1,5 @@ +set(VCPKG_POLICY_EMPTY_PACKAGE enabled) +vcpkg_cmake_configure( + SOURCE_PATH "${CURRENT_PORT_DIR}/project" +) +vcpkg_cmake_build() diff --git a/scripts/test_ports/vcpkg-ci-gifdec/project/CMakeLists.txt b/scripts/test_ports/vcpkg-ci-gifdec/project/CMakeLists.txt new file mode 100644 index 00000000000000..958f3a23adbe7e --- /dev/null +++ b/scripts/test_ports/vcpkg-ci-gifdec/project/CMakeLists.txt @@ -0,0 +1,5 @@ +cmake_minimum_required(VERSION 3.22) +project(gifdec-test LANGUAGES C) +find_package(unofficial-gifdec CONFIG REQUIRED) +add_executable(main main.c) +target_link_libraries(main PRIVATE unofficial::gifdec::gifdec) diff --git a/scripts/test_ports/vcpkg-ci-gifdec/project/main.c b/scripts/test_ports/vcpkg-ci-gifdec/project/main.c new file mode 100644 index 00000000000000..b1e33caeb7b681 --- /dev/null +++ b/scripts/test_ports/vcpkg-ci-gifdec/project/main.c @@ -0,0 +1,8 @@ +#include +int main() +{ + gd_GIF *gif; + gif = gd_open_gif("test.gif"); + gd_close_gif(gif); + return 0; +} diff --git a/scripts/test_ports/vcpkg-ci-gifdec/vcpkg.json b/scripts/test_ports/vcpkg-ci-gifdec/vcpkg.json new file mode 100644 index 00000000000000..d94771b1e1372d --- /dev/null +++ b/scripts/test_ports/vcpkg-ci-gifdec/vcpkg.json @@ -0,0 +1,12 @@ +{ + "name": "vcpkg-ci-gifdec", + "version-string": "ci", + "description": "Validates gifdec", + "dependencies": [ + "gifdec", + { + "name": "vcpkg-cmake", + "host": true + } + ] +} diff --git a/versions/baseline.json b/versions/baseline.json index 1ad310b70a2fc4..0a1a46c72bfb73 100644 --- a/versions/baseline.json +++ b/versions/baseline.json @@ -3432,6 +3432,10 @@ "baseline": "2019-10-07", "port-version": 3 }, + "gifdec": { + "baseline": "2021-12-04", + "port-version": 0 + }, "giflib": { "baseline": "6.1.3", "port-version": 0 diff --git a/versions/g-/gifdec.json b/versions/g-/gifdec.json new file mode 100644 index 00000000000000..d899b3257ad809 --- /dev/null +++ b/versions/g-/gifdec.json @@ -0,0 +1,9 @@ +{ + "versions": [ + { + "git-tree": "f39ccac94aae461d963c1d52ebf17b65ae8a018c", + "version-date": "2021-12-04", + "port-version": 0 + } + ] +} From a129b75c50a5516a9ebecde7dcba83216bfb9a95 Mon Sep 17 00:00:00 2001 From: Saikari Date: Tue, 4 Aug 2026 15:20:37 +0300 Subject: [PATCH 2/9] Remove debug include directory from gifdec package installation --- ports/gifdec/portfile.cmake | 1 + versions/g-/gifdec.json | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/ports/gifdec/portfile.cmake b/ports/gifdec/portfile.cmake index 2e89558c654b9e..cf712f1d49c989 100644 --- a/ports/gifdec/portfile.cmake +++ b/ports/gifdec/portfile.cmake @@ -19,5 +19,6 @@ vcpkg_cmake_configure( vcpkg_cmake_install() vcpkg_cmake_config_fixup(PACKAGE_NAME unofficial-gifdec CONFIG_PATH lib/cmake/unofficial-gifdec) +file(REMOVE_RECURSE "${CURRENT_PACKAGES_DIR}/debug/include") file(WRITE "${SOURCE_PATH}/LICENSE" [[gifdec is released into the public domain, as stated in its README file.]]) vcpkg_install_copyright(FILE_LIST "${SOURCE_PATH}/LICENSE") diff --git a/versions/g-/gifdec.json b/versions/g-/gifdec.json index d899b3257ad809..a01d520d2747ea 100644 --- a/versions/g-/gifdec.json +++ b/versions/g-/gifdec.json @@ -1,7 +1,7 @@ { "versions": [ { - "git-tree": "f39ccac94aae461d963c1d52ebf17b65ae8a018c", + "git-tree": "1ab8d9f277325054176f59e746a06486a5f87c60", "version-date": "2021-12-04", "port-version": 0 } From deb1338fdc0c79b911bb5c6485f51c67956ef13c Mon Sep 17 00:00:00 2001 From: Saikari Date: Tue, 4 Aug 2026 15:27:23 +0300 Subject: [PATCH 3/9] Add Windows linkage check for gifdec port --- ports/gifdec/portfile.cmake | 4 ++++ versions/g-/gifdec.json | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/ports/gifdec/portfile.cmake b/ports/gifdec/portfile.cmake index cf712f1d49c989..d2b27fb160c29a 100644 --- a/ports/gifdec/portfile.cmake +++ b/ports/gifdec/portfile.cmake @@ -1,3 +1,7 @@ +if(VCPKG_TARGET_IS_WINDOWS) + vcpkg_check_linkage(ONLY_STATIC_LIBRARY) +endif() + vcpkg_from_github( OUT_SOURCE_PATH SOURCE_PATH REPO lecram/gifdec diff --git a/versions/g-/gifdec.json b/versions/g-/gifdec.json index a01d520d2747ea..4fd95d2f674099 100644 --- a/versions/g-/gifdec.json +++ b/versions/g-/gifdec.json @@ -1,7 +1,7 @@ { "versions": [ { - "git-tree": "1ab8d9f277325054176f59e746a06486a5f87c60", + "git-tree": "83132112f3f610ae66a700512c3cc055b5d07383", "version-date": "2021-12-04", "port-version": 0 } From 0a12ef0f0dd29218c5dac9fbddad3c8a5c0e8e6e Mon Sep 17 00:00:00 2001 From: Billy Robert O'Neal III Date: Tue, 4 Aug 2026 15:11:17 -0700 Subject: [PATCH 4/9] [gifdec] Fix package metadata Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- ports/gifdec/portfile.cmake | 3 +-- ports/gifdec/unofficial-gifdec-config.cmake.in | 2 +- versions/g-/gifdec.json | 2 +- 3 files changed, 3 insertions(+), 4 deletions(-) diff --git a/ports/gifdec/portfile.cmake b/ports/gifdec/portfile.cmake index d2b27fb160c29a..7bf818e4d13fcd 100644 --- a/ports/gifdec/portfile.cmake +++ b/ports/gifdec/portfile.cmake @@ -24,5 +24,4 @@ vcpkg_cmake_install() vcpkg_cmake_config_fixup(PACKAGE_NAME unofficial-gifdec CONFIG_PATH lib/cmake/unofficial-gifdec) file(REMOVE_RECURSE "${CURRENT_PACKAGES_DIR}/debug/include") -file(WRITE "${SOURCE_PATH}/LICENSE" [[gifdec is released into the public domain, as stated in its README file.]]) -vcpkg_install_copyright(FILE_LIST "${SOURCE_PATH}/LICENSE") +vcpkg_install_copyright(FILE_LIST "${SOURCE_PATH}/README") diff --git a/ports/gifdec/unofficial-gifdec-config.cmake.in b/ports/gifdec/unofficial-gifdec-config.cmake.in index c0b32adb33ebdd..e71a55e6692763 100644 --- a/ports/gifdec/unofficial-gifdec-config.cmake.in +++ b/ports/gifdec/unofficial-gifdec-config.cmake.in @@ -1,3 +1,3 @@ @PACKAGE_INIT@ include("${CMAKE_CURRENT_LIST_DIR}/unofficial-gifdec-targets.cmake") -check_required_components("gifdec") +check_required_components("unofficial-gifdec") diff --git a/versions/g-/gifdec.json b/versions/g-/gifdec.json index 4fd95d2f674099..07f643adecf7c4 100644 --- a/versions/g-/gifdec.json +++ b/versions/g-/gifdec.json @@ -1,7 +1,7 @@ { "versions": [ { - "git-tree": "83132112f3f610ae66a700512c3cc055b5d07383", + "git-tree": "fb237b50839497ef50661626b4cf2f50627f122e", "version-date": "2021-12-04", "port-version": 0 } From 3cbde8a75d5bfb880c4d1a6a1da1e7bea8b21fe0 Mon Sep 17 00:00:00 2001 From: Saikari Date: Wed, 5 Aug 2026 09:42:21 +0300 Subject: [PATCH 5/9] Add CVE fix patch for gifdec port --- ports/gifdec/portfile.cmake | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/ports/gifdec/portfile.cmake b/ports/gifdec/portfile.cmake index 7bf818e4d13fcd..1655437a52bf27 100644 --- a/ports/gifdec/portfile.cmake +++ b/ports/gifdec/portfile.cmake @@ -1,3 +1,10 @@ +vcpkg_download_distfile( + FIX_CVE + URLS https://github.com/lecram/gifdec/pull/23.patch?full_index=1 + FILENAME fix-cve.patch + SHA512 457deb349492206c473edcc09fdc654261a2277307272c1716cc7ef42b0f75302039a7b453ddb355d7195bc5e1ac068a431f5fed5adc3161a3ee60ab03295a65 +) + if(VCPKG_TARGET_IS_WINDOWS) vcpkg_check_linkage(ONLY_STATIC_LIBRARY) endif() @@ -8,6 +15,8 @@ vcpkg_from_github( REF 1dcbae19363597314f6623010cc80abad4e47f7c SHA512 2756004cb7dd8be5560a32c188001da503b97f1b8e3eed908787563b7e36edf8cbca3605e2e75b2ebbc69b329e16d89b3237028dfd7a772d2763bf78b1675ad2 HEAD_REF master + PATCHES + "${FIX_CVE}" ) file(COPY From c6140ed9c6fe3b6cb24679b8478637a5cd76aef0 Mon Sep 17 00:00:00 2001 From: Saikari Date: Wed, 5 Aug 2026 09:49:19 +0300 Subject: [PATCH 6/9] Update CVE patch reference and version in gifdec port --- ports/gifdec/portfile.cmake | 6 +++--- versions/g-/gifdec.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/ports/gifdec/portfile.cmake b/ports/gifdec/portfile.cmake index 1655437a52bf27..026cb3aa840c6a 100644 --- a/ports/gifdec/portfile.cmake +++ b/ports/gifdec/portfile.cmake @@ -1,7 +1,7 @@ vcpkg_download_distfile( - FIX_CVE + FIX-CVE-2022-43359 URLS https://github.com/lecram/gifdec/pull/23.patch?full_index=1 - FILENAME fix-cve.patch + FILENAME FIX-CVE-2022-43359.patch SHA512 457deb349492206c473edcc09fdc654261a2277307272c1716cc7ef42b0f75302039a7b453ddb355d7195bc5e1ac068a431f5fed5adc3161a3ee60ab03295a65 ) @@ -16,7 +16,7 @@ vcpkg_from_github( SHA512 2756004cb7dd8be5560a32c188001da503b97f1b8e3eed908787563b7e36edf8cbca3605e2e75b2ebbc69b329e16d89b3237028dfd7a772d2763bf78b1675ad2 HEAD_REF master PATCHES - "${FIX_CVE}" + "${FIX-CVE-2022-43359}" ) file(COPY diff --git a/versions/g-/gifdec.json b/versions/g-/gifdec.json index 07f643adecf7c4..3f67dbd01287a1 100644 --- a/versions/g-/gifdec.json +++ b/versions/g-/gifdec.json @@ -1,7 +1,7 @@ { "versions": [ { - "git-tree": "fb237b50839497ef50661626b4cf2f50627f122e", + "git-tree": "5154d63718c6e4f20fb6b50f32b0f1595b0b95dc", "version-date": "2021-12-04", "port-version": 0 } From bdb1bf096c5041fb60b833b4236cc803092799d4 Mon Sep 17 00:00:00 2001 From: Saikari Date: Wed, 5 Aug 2026 10:02:52 +0300 Subject: [PATCH 7/9] vdb --- versions/g-/gifdec.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/versions/g-/gifdec.json b/versions/g-/gifdec.json index 3f67dbd01287a1..5471b41925db66 100644 --- a/versions/g-/gifdec.json +++ b/versions/g-/gifdec.json @@ -1,7 +1,7 @@ { "versions": [ { - "git-tree": "5154d63718c6e4f20fb6b50f32b0f1595b0b95dc", + "git-tree": "71f0d5ec637eb3c3601e39754b6d9abdbc12c66d", "version-date": "2021-12-04", "port-version": 0 } From d1a4134728e0baf4622fd9c2ece7ba49f7aee740 Mon Sep 17 00:00:00 2001 From: Saikari Date: Thu, 6 Aug 2026 07:43:20 +0300 Subject: [PATCH 8/9] store patch --- ports/gifdec/FIX-CVE-2022-43359.patch | 201 ++++++++++++++++++++++++++ ports/gifdec/portfile.cmake | 9 +- versions/g-/gifdec.json | 2 +- 3 files changed, 203 insertions(+), 9 deletions(-) create mode 100644 ports/gifdec/FIX-CVE-2022-43359.patch diff --git a/ports/gifdec/FIX-CVE-2022-43359.patch b/ports/gifdec/FIX-CVE-2022-43359.patch new file mode 100644 index 00000000000000..8be87c989d54c3 --- /dev/null +++ b/ports/gifdec/FIX-CVE-2022-43359.patch @@ -0,0 +1,201 @@ +From 777d74f806f7e9241336efd1c76865c07e2f0436 Mon Sep 17 00:00:00 2001 +From: everestsummer +Date: Sat, 20 Aug 2022 13:21:07 +0800 +Subject: [PATCH 1/6] Fix: Security: Uninitialized variables may cause SIGSEGV + +--- + gifdec.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/gifdec.c b/gifdec.c +index 83c2d0f5b4ba5fa45e70d3decab2b133d3cc6ce3..61448ecc5ef710615f534a69c99f64bf90e40714 100644 +--- a/gifdec.c ++++ b/gifdec.c +@@ -333,12 +333,12 @@ static int + read_image_data(gd_GIF *gif, int interlace) + { + uint8_t sub_len, shift, byte; +- int init_key_size, key_size, table_is_full; +- int frm_off, frm_size, str_len, i, p, x, y; ++ int init_key_size, key_size, table_is_full = 0; ++ int frm_off, frm_size, str_len = 0, i, p, x, y; + uint16_t key, clear, stop; + int ret; + Table *table; +- Entry entry; ++ Entry entry = { 0 }; + off_t start, end; + + read(gif->fd, &byte, 1); + +From f29dc41102ea62f4d6a1c9e9438e8addf81fb1ab Mon Sep 17 00:00:00 2001 +From: everestsummer +Date: Sat, 20 Aug 2022 13:25:23 +0800 +Subject: [PATCH 2/6] Fix: Security: 'key' maybe a value bigger than + table->nentries, causing out of bounds read access. + +--- + gifdec.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/gifdec.c b/gifdec.c +index 61448ecc5ef710615f534a69c99f64bf90e40714..8f0e2db3fc4ae416df190b9d6ae5c174d92bedc8 100644 +--- a/gifdec.c ++++ b/gifdec.c +@@ -379,6 +379,7 @@ read_image_data(gd_GIF *gif, int interlace) + key = get_key(gif, key_size, &sub_len, &shift, &byte); + if (key == clear) continue; + if (key == stop || key == 0x1000) break; ++ if (key >= table->nentries) break; + if (ret == 1) key_size++; + entry = table->entries[key]; + str_len = entry.length; + +From 970558212348b60359f967a5d999078b6f9efe04 Mon Sep 17 00:00:00 2001 +From: everestsummer +Date: Sat, 20 Aug 2022 13:36:15 +0800 +Subject: [PATCH 3/6] Fix: Security: entry.prefix may be a bigger value than + table->nentries, causing oob read. + +--- + gifdec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/gifdec.c b/gifdec.c +index 8f0e2db3fc4ae416df190b9d6ae5c174d92bedc8..c6718e147dc710534cd3423c5807adde730150fc 100644 +--- a/gifdec.c ++++ b/gifdec.c +@@ -390,7 +390,7 @@ read_image_data(gd_GIF *gif, int interlace) + if (interlace) + y = interlaced_line_index((int) gif->fh, y); + gif->frame[(gif->fy + y) * gif->width + gif->fx + x] = entry.suffix; +- if (entry.prefix == 0xFFF) ++ if (entry.prefix == 0xFFF || entry.prefix >= table->nentries) + break; + else + entry = table->entries[entry.prefix]; + +From bdfad6b169f758a0c74cf7ddde7f591cfd8ef248 Mon Sep 17 00:00:00 2001 +From: everestsummer +Date: Sat, 20 Aug 2022 15:43:10 +0800 +Subject: [PATCH 4/6] Fix: Security: Infinite loop in discard_sub_blocks + +--- + gifdec.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/gifdec.c b/gifdec.c +index c6718e147dc710534cd3423c5807adde730150fc..de1e303d46f4127af0161be9177253ac55045a65 100644 +--- a/gifdec.c ++++ b/gifdec.c +@@ -121,11 +121,17 @@ gd_open_gif(const char *fname) + static void + discard_sub_blocks(gd_GIF *gif) + { ++ uint8_t first_try = 1; ++ uint8_t seek_pos; + uint8_t size; + + do { + read(gif->fd, &size, 1); ++ if (!first_try && size == seek_pos) //To prevent infinite loop ++ break; + lseek(gif->fd, size, SEEK_CUR); ++ seek_pos = size; ++ first_try = 0; + } while (size); + } + + +From 271d1d22ce3d86ecddbd0f9205f0b70fa9fd7529 Mon Sep 17 00:00:00 2001 +From: everestsummer +Date: Sat, 20 Aug 2022 15:43:58 +0800 +Subject: [PATCH 5/6] Fix: Security: Infinite loop in read_ext + +--- + gifdec.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/gifdec.c b/gifdec.c +index de1e303d46f4127af0161be9177253ac55045a65..dd2d5b3e77a88129823be9dec6bc6a1e9683a0ef 100644 +--- a/gifdec.c ++++ b/gifdec.c +@@ -224,7 +224,8 @@ read_ext(gd_GIF *gif) + { + uint8_t label; + +- read(gif->fd, &label, 1); ++ if(read(gif->fd, &label, 1) < 1) ++ return; + switch (label) { + case 0x01: + read_plain_text_ext(gif); +@@ -502,7 +503,8 @@ gd_get_frame(gd_GIF *gif) + if (sep == '!') + read_ext(gif); + else return -1; +- read(gif->fd, &sep, 1); ++ if(read(gif->fd, &sep, 1) < 1) ++ return -1; + } + if (read_image(gif) == -1) + return -1; + +From b17f41093397ef0b698dd718ab109625716414fe Mon Sep 17 00:00:00 2001 +From: everestsummer +Date: Sat, 20 Aug 2022 16:44:41 +0800 +Subject: [PATCH 6/6] Fix: Security: Prevent i from being overflowed to + negative value (and SIGSEGV) + +--- + gifdec.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/gifdec.c b/gifdec.c +index dd2d5b3e77a88129823be9dec6bc6a1e9683a0ef..75bfc7d4af628389a4f362bb9728fd581e4dabf0 100644 +--- a/gifdec.c ++++ b/gifdec.c +@@ -44,7 +44,7 @@ gd_open_gif(const char *fname) + uint8_t sigver[3]; + uint16_t width, height, depth; + uint8_t fdsz, bgidx, aspect; +- int i; ++ size_t i; + uint8_t *bgcolor; + int gct_sz; + gd_GIF *gif; +@@ -121,13 +121,13 @@ gd_open_gif(const char *fname) + static void + discard_sub_blocks(gd_GIF *gif) + { +- uint8_t first_try = 1; ++ uint8_t first_try = 1; + uint8_t seek_pos; + uint8_t size; + + do { + read(gif->fd, &size, 1); +- if (!first_try && size == seek_pos) //To prevent infinite loop ++ if (!first_try && size == seek_pos) //To prevent infinite loop + break; + lseek(gif->fd, size, SEEK_CUR); + seek_pos = size; +@@ -225,7 +225,8 @@ read_ext(gd_GIF *gif) + uint8_t label; + + if(read(gif->fd, &label, 1) < 1) +- return; ++ return; ++ + switch (label) { + case 0x01: + read_plain_text_ext(gif); +@@ -504,7 +505,7 @@ gd_get_frame(gd_GIF *gif) + read_ext(gif); + else return -1; + if(read(gif->fd, &sep, 1) < 1) +- return -1; ++ return -1; + } + if (read_image(gif) == -1) + return -1; diff --git a/ports/gifdec/portfile.cmake b/ports/gifdec/portfile.cmake index 026cb3aa840c6a..33fa02beb53fda 100644 --- a/ports/gifdec/portfile.cmake +++ b/ports/gifdec/portfile.cmake @@ -1,10 +1,3 @@ -vcpkg_download_distfile( - FIX-CVE-2022-43359 - URLS https://github.com/lecram/gifdec/pull/23.patch?full_index=1 - FILENAME FIX-CVE-2022-43359.patch - SHA512 457deb349492206c473edcc09fdc654261a2277307272c1716cc7ef42b0f75302039a7b453ddb355d7195bc5e1ac068a431f5fed5adc3161a3ee60ab03295a65 -) - if(VCPKG_TARGET_IS_WINDOWS) vcpkg_check_linkage(ONLY_STATIC_LIBRARY) endif() @@ -16,7 +9,7 @@ vcpkg_from_github( SHA512 2756004cb7dd8be5560a32c188001da503b97f1b8e3eed908787563b7e36edf8cbca3605e2e75b2ebbc69b329e16d89b3237028dfd7a772d2763bf78b1675ad2 HEAD_REF master PATCHES - "${FIX-CVE-2022-43359}" + FIX-CVE-2022-43359.patch ) file(COPY diff --git a/versions/g-/gifdec.json b/versions/g-/gifdec.json index 5471b41925db66..2cad706308e221 100644 --- a/versions/g-/gifdec.json +++ b/versions/g-/gifdec.json @@ -1,7 +1,7 @@ { "versions": [ { - "git-tree": "71f0d5ec637eb3c3601e39754b6d9abdbc12c66d", + "git-tree": "2f4b99fdebaf7c596a86c52b3ed2fe86b8fae885", "version-date": "2021-12-04", "port-version": 0 } From 8aa6579044105a7762affbf21f4a4fc1d8925096 Mon Sep 17 00:00:00 2001 From: Saikari Date: Thu, 6 Aug 2026 07:47:04 +0300 Subject: [PATCH 9/9] repair baseline --- versions/baseline.json | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/versions/baseline.json b/versions/baseline.json index 8274f88d0c7bcb..c2a9cf9ee34bf9 100644 --- a/versions/baseline.json +++ b/versions/baseline.json @@ -3432,6 +3432,10 @@ "baseline": "2019-10-07", "port-version": 3 }, + "gif-load": { + "baseline": "2019-01-06", + "port-version": 0 + }, "gifdec": { "baseline": "2021-12-04", "port-version": 0