From 212fd4a4ce1f89e8bbb6e6ab5a16053276234131 Mon Sep 17 00:00:00 2001
From: Anthony Hurtado <amhurtado@protonmail.com>
Date: Mon, 1 Jun 2026 15:40:48 -0500
Subject: [PATCH 1/3] Fix CVE-2026-26740: heap OOB write in
 EGifGCBToSavedExtension

EGifGCBToSavedExtension calls EGifGCBToExtension which unconditionally
writes 4 bytes into ep->Bytes without checking ep->ByteCount.  If the
extension block was allocated with fewer than 4 bytes, this results in
a heap buffer overflow.

The read-side counterpart DGifExtensionToGCB already validates that
GifExtensionLength == 4 before reading.  Add the symmetric check on
the write side: return GIF_ERROR when ep->ByteCount < 4.

Signed-off-by: Anthony Hurtado <amhurtado@pm.me>
---
 egif_lib.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/egif_lib.c b/egif_lib.c
index f1141a2..d74e8df 100644
--- a/egif_lib.c
+++ b/egif_lib.c
@@ -690,6 +690,9 @@ int EGifGCBToSavedExtension(const GraphicsControlBlock *GCB,
 		ExtensionBlock *ep =
 		    &GifFile->SavedImages[ImageIndex].ExtensionBlocks[i];
 		if (ep->Function == GRAPHICS_EXT_FUNC_CODE) {
+			if (ep->ByteCount < 4) {
+				return GIF_ERROR;
+			}
 			EGifGCBToExtension(GCB, ep->Bytes);
 			return GIF_OK;
 		}
-- 
2.55.0

