Skip to content

AccessViolationException when decoding gif #2859

Closed
Bug
Closed
AccessViolationException when decoding gif#2859
Bug
Labels
bugformats:gifsecurity

Description

@andreas-eriksson
andreas-eriksson
opened on Jan 14, 2025

Prerequisites

  • I have written a descriptive issue title
  • I have verified that I am running the latest version of ImageSharp
  • I have verified if the problem exist in both DEBUG and RELEASE mode
  • I have searched open and closed issues to ensure it has not already been reported

ImageSharp version

3.1.6

Other ImageSharp packages and versions

N/A

Environment (Operating system, version and so on)

Windows 11

.NET Framework version

.NET 8

Description

Loading the attached gif causes an AccessViolationException and brings down the process.

at SixLabors.ImageSharp.Formats.Gif.LzwDecoder.DecodePixelRow(System.Span`1<Byte>)
at SixLabors.ImageSharp.Formats.Gif.GifDecoderCore.ReadFrameColors[[SixLabors.ImageSharp.PixelFormats.Rgba32, SixLabors.ImageSharp, Version=3.0.0.0, Culture=neutral, PublicKeyToken=d998eea7b14cab13]](SixLabors.ImageSharp.IO.BufferedReadStream, SixLabors.ImageSharp.Image`1<SixLabors.ImageSharp.PixelFormats.Rgba32> ByRef, SixLabors.ImageSharp.ImageFrame`1<SixLabors.ImageSharp.PixelFormats.Rgba32> ByRef, System.ReadOnlySpan`1<SixLabors.ImageSharp.PixelFormats.Rgb24>, SixLabors.ImageSharp.Formats.Gif.GifImageDescriptor ByRef)
at SixLabors.ImageSharp.Formats.Gif.GifDecoderCore.ReadFrame[[SixLabors.ImageSharp.PixelFormats.Rgba32, SixLabors.ImageSharp, Version=3.0.0.0, Culture=neutral, PublicKeyToken=d998eea7b14cab13]](SixLabors.ImageSharp.IO.BufferedReadStream, SixLabors.ImageSharp.Image`1<SixLabors.ImageSharp.PixelFormats.Rgba32> ByRef, SixLabors.ImageSharp.ImageFrame`1<SixLabors.ImageSharp.PixelFormats.Rgba32> ByRef)
at SixLabors.ImageSharp.Formats.Gif.GifDecoderCore.Decode[[SixLabors.ImageSharp.PixelFormats.Rgba32, SixLabors.ImageSharp, Version=3.0.0.0, Culture=neutral, PublicKeyToken=d998eea7b14cab13]](SixLabors.ImageSharp.IO.BufferedReadStream, System.Threading.CancellationToken)
at SixLabors.ImageSharp.Formats.ImageDecoderCore.Decode[[SixLabors.ImageSharp.PixelFormats.Rgba32, SixLabors.ImageSharp, Version=3.0.0.0, Culture=neutral, PublicKeyToken=d998eea7b14cab13]](SixLabors.ImageSharp.Configuration, System.IO.Stream, System.Threading.CancellationToken)
at SixLabors.ImageSharp.Formats.Gif.GifDecoder.Decode[[SixLabors.ImageSharp.PixelFormats.Rgba32, SixLabors.ImageSharp, Version=3.0.0.0, Culture=neutral, PublicKeyToken=d998eea7b14cab13]](SixLabors.ImageSharp.Formats.DecoderOptions, System.IO.Stream, System.Threading.CancellationToken)
at SixLabors.ImageSharp.Formats.Gif.GifDecoder.Decode(SixLabors.ImageSharp.Formats.DecoderOptions, System.IO.Stream, System.Threading.CancellationToken)
at SixLabors.ImageSharp.Formats.ImageDecoder+<>c__DisplayClass1_0.<Decode>b__0(System.IO.Stream)
at SixLabors.ImageSharp.Formats.ImageDecoder.<WithSeekableStream>g__PerformActionAndResetPosition|11_0[[System.__Canon, System.Private.CoreLib, Version=8.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]](System.IO.Stream, Int64, <>c__DisplayClass11_0`1<System.__Canon> ByRef)
at SixLabors.ImageSharp.Formats.ImageDecoder.WithSeekableStream[[System.__Canon, System.Private.CoreLib, Version=8.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]](SixLabors.ImageSharp.Formats.DecoderOptions, System.IO.Stream, System.Func`2<System.IO.Stream,System.__Canon>)
at SixLabors.ImageSharp.Formats.ImageDecoder.Decode(SixLabors.ImageSharp.Formats.DecoderOptions, System.IO.Stream)
at SixLabors.ImageSharp.Image.Decode(SixLabors.ImageSharp.Formats.DecoderOptions, System.IO.Stream)
at SixLabors.ImageSharp.Image+<>c__DisplayClass80_0.<Load>b__0(System.IO.Stream)
at SixLabors.ImageSharp.Image.WithSeekableStream[[System.__Canon, System.Private.CoreLib, Version=8.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]](SixLabors.ImageSharp.Formats.DecoderOptions, System.IO.Stream, System.Func`2<System.IO.Stream,System.__Canon>)
at SixLabors.ImageSharp.Image.Load(SixLabors.ImageSharp.Formats.DecoderOptions, System.IO.Stream)
at SixLabors.ImageSharp.Image.Load(System.IO.Stream)

Steps to Reproduce

using var image = Image.Load("corrupt.gif");

Images

corrupt

Activity

  1. andreas-eriksson
    added
    needs triage
    on Jan 14, 2025

  2. andreas-eriksson commented on Feb 4, 2025

    @andreas-eriksson
    andreas-eriksson
    on Feb 4, 2025
    ContributorAuthor

    Here is another gif that causes the same hard crash.

    Image

  3. JimBobSquarePants commented on Feb 4, 2025

    @JimBobSquarePants
    JimBobSquarePants
    on Feb 4, 2025
    Member

    Thanks. I’ll investigate it asap

  4. JimBobSquarePants
    added
    bug
    formats:gif
    security
    and removed
    needs triage
    on Feb 4, 2025
  5. tocsoft
    marked AccessViolationException when opening GIF #2883 as a duplicate of this issue on Feb 7, 2025
  6. JimBobSquarePants
    added a commit that references this issue on Feb 10, 2025

    Fix #2859

    29f17eb
  7. JimBobSquarePants
    closed this as completedin 29f17ebon Feb 10, 2025
  8. antonfirsov
    added a commit that references this issue on Feb 20, 2025

    Backport #2859 to release/2.1

    367c077
  9. JimBobSquarePants
    added a commit that references this issue on Feb 23, 2025

    Merge pull request #2890 from SixLabors/af/backport-2859

    627b5f7

  10. andreas-eriksson commented on Mar 6, 2025

    @andreas-eriksson
    andreas-eriksson
    on Mar 6, 2025
    ContributorAuthor

    Thanks for fixing this 👍

    Will this be reported as a CVE?
    Will there be a public release with the fix?

  11. JimBobSquarePants commented on Mar 6, 2025

    @JimBobSquarePants
    JimBobSquarePants
    on Mar 6, 2025
    Member

    Yes, there will be. CVE identifier has been requested and will hopefully get a release out very soon.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugformats:gifsecurity

    Type

    Bug

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions