From: Gyorgy Sarvari <skandigraun@gmail.com>
To: openembedded-devel@lists.openembedded.org
Subject: [meta-oe][whinlatter][PATCH v2] giflib: patch CVE-2025-31344
Date: Thu, 9 Apr 2026 10:36:45 +0200 [thread overview]
Message-ID: <20260409083645.577288-1-skandigraun@gmail.com> (raw)
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-31344
Backport the commit that mentions this CVE ID explicitly
in its message.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
v2: fix typo in subject
.../giflib/giflib/CVE-2025-31344.patch | 28 +++++++++++++++++++
.../recipes-devtools/giflib/giflib_5.2.2.bb | 3 +-
2 files changed, 30 insertions(+), 1 deletion(-)
create mode 100644 meta-oe/recipes-devtools/giflib/giflib/CVE-2025-31344.patch
diff --git a/meta-oe/recipes-devtools/giflib/giflib/CVE-2025-31344.patch b/meta-oe/recipes-devtools/giflib/giflib/CVE-2025-31344.patch
new file mode 100644
index 0000000000..8f52154955
--- /dev/null
+++ b/meta-oe/recipes-devtools/giflib/giflib/CVE-2025-31344.patch
@@ -0,0 +1,28 @@
+From 949bf7ded2c23449439e2c3e1f63368cf7985800 Mon Sep 17 00:00:00 2001
+From: "Eric S. Raymond" <esr@thyrsus.com>
+Date: Wed, 18 Feb 2026 18:06:50 -0500
+Subject: [PATCH] Resolve SourceForge bug #187: CVE-2025-31344
+
+CVE: CVE-2025-31344
+Upstream-Status: Backport [https://sourceforge.net/p/giflib/code/ci/7bbe8ea1a595bb7509ffa0a86b076e9b720e85af]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ gif2rgb.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/gif2rgb.c b/gif2rgb.c
+index d51226d..4ce2104 100644
+--- a/gif2rgb.c
++++ b/gif2rgb.c
+@@ -329,6 +329,11 @@ static void DumpScreen2RGB(char *FileName, int OneFileFlag,
+ GifRow = ScreenBuffer[i];
+ GifQprintf("\b\b\b\b%-4d", ScreenHeight - i);
+ for (j = 0; j < ScreenWidth; j++) {
++ /* Check if color is within color palete */
++ if (GifRow[j] >= ColorMap->ColorCount) {
++ GIF_EXIT(GifErrorString(
++ D_GIF_ERR_IMAGE_DEFECT));
++ }
+ ColorMapEntry = &ColorMap->Colors[GifRow[j]];
+ Buffers[0][j] = ColorMapEntry->Red;
+ Buffers[1][j] = ColorMapEntry->Green;
diff --git a/meta-oe/recipes-devtools/giflib/giflib_5.2.2.bb b/meta-oe/recipes-devtools/giflib/giflib_5.2.2.bb
index 8226e9b6c7..c26f3cf160 100644
--- a/meta-oe/recipes-devtools/giflib/giflib_5.2.2.bb
+++ b/meta-oe/recipes-devtools/giflib/giflib_5.2.2.bb
@@ -11,7 +11,8 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/giflib/${BP}.tar.gz \
https://sourceforge.net/p/giflib/code/ci/d54b45b0240d455bbaedee4be5203d2703e59967/tree/doc/giflib-logo.gif?format=raw;subdir=${BP}/doc;name=logo;downloadfilename=giflib-logo.gif \
file://0001-Makefile-fix-typo-in-soname-argument.patch \
file://CVE-2026-23868.patch \
-"
+ file://CVE-2025-31344.patch \
+ "
SRC_URI[logo.sha256sum] = "1a54383986adad1521d00e003b4c482c27e8bc60690be944a1f3319c75abc2c9"
SRC_URI[sha256sum] = "be7ffbd057cadebe2aa144542fd90c6838c6a083b5e8a9048b8ee3b66b29d5fb"
reply other threads:[~2026-04-09 8:36 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260409083645.577288-1-skandigraun@gmail.com \
--to=skandigraun@gmail.com \
--cc=openembedded-devel@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox