3 ms·
I'd like to point out the previous version written in C might have multiple vulnerabilities. The author has shown complete disregard for security, closed issues
by martin-t 7y ago
I'd like to point out the previous version written in C might have multiple vulnerabilities. The author has shown complete disregard for security, closed issues reporting them [1-3] and tried to make fuzzing harder [4].
[1]: https://gitlab.com/esr/gif2png/issues/5 https://gitlab.com/esr/gif2png/issues/5
[2]: https://gitlab.com/esr/gif2png/issues/6 https://gitlab.com/esr/gif2png/issues/6
[3]: https://gitlab.com/esr/gif2png/issues/7 https://gitlab.com/esr/gif2png/issues/7
[4]: https://gitlab.com/esr/gif2png/commit/a8a761561b2a071e7452a00868efd5bdf795c443 https://gitlab.com/esr/gif2png/commit/a8a761561b2a071e7452a0...
He also seems to think (potential) UB is an issue with the optimizer instead of his code as indicated by this comment: https://gitlab.com/esr/gif2png/issues/1#note_150727440 https://gitlab.com/esr/gif2png/issues/1#note_150727440