From 99ba5c353373ed198f54af66fe4e355ebb96e363 Mon Sep 17 00:00:00 2001
From: LEPILLER Julien <julien@lepiller.eu>
Date: Thu, 3 Aug 2017 17:04:17 +0200
Subject: [PATCH] Fix #399: Buffer over-read into uninitialized memory.

The stack allocated color map buffers were not zeroed before usage, and
so undefined palette indexes could cause information leakage.

This is CVE-2017-7890.
---
 src/gd_gif_in.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/gd_gif_in.c b/src/gd_gif_in.c
index 008d1ec..c195448 100644
--- a/src/gd_gif_in.c
+++ b/src/gd_gif_in.c
@@ -216,6 +216,9 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromGifCtx(gdIOCtxPtr fd)
 
 	gdImagePtr im = 0;
 
+	memset(ColorMap, 0, 3 * MAXCOLORMAPSIZE);
+	memset(localColorMap, 0, 3 * MAXCOLORMAPSIZE);
+
 	if(!ReadOK(fd, buf, 6)) {
 		return 0;
 	}
-- 
2.13.3