ANT-2026-G1XC2M5V: cgif/cgif_fuzzer/20251218_020844_unknown/

cgif's LZW encoder computes a conservative upper bound for the compressed output buffer but the formula only covers the initial clear code, numPixel data codes, and the termination code. It fails to account for the N reset clear codes emitted whenever the LZW dictionary fills and is reset. For inputs whose pixel patterns force many dictionary resets, the encoder emits more codes than the allocated buffer can hold, producing a heap buffer write overflow. An attacker who can influence the pixel data fed to the encoder (e.g., via an image-processing pipeline that re-encodes to GIF) could trigger this corruption.

Target

Project: cgif
Location: src/cgif_raw.c:LZW_GenerateStream
Discovery: static analysis — not yet dynamically reproduced

Technical Details

Root cause is an incomplete worst-case size formula: the buffer must hold at most 1 initial clear code + numPixel data codes + N reset clear codes + 1 termination code, but the N reset clear codes term was missing, so the malloc is undersized and subsequent code emission overruns it.

Reproduction

This finding was identified by static analysis and has not yet been dynamically reproduced. The Technical Details section above describes the code path; a trigger input is not included.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-G1XC2M5V.

---

Reference: ANT-2026-G1XC2M5V
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

{
  "ant_id": "ANT-2026-G1XC2M5V",
  "bug_class": null,
  "claude_severity": "high",
  "commit_sha": null,
  "created_at": "2026-03-29T20:43:33+00:00",
  "description": "cgif's LZW encoder computes a conservative upper bound for the compressed output buffer but the formula only covers the initial clear code, numPixel data codes, and the termination code. It fails to account for the N reset clear codes emitted whenever the LZW dictionary fills and is reset. For inputs whose pixel patterns force many dictionary resets, the encoder emits more codes than the allocated buffer can hold, producing a heap buffer write overflow. An attacker who can influence the pixel data fed to the encoder (e.g., via an image-processing pipeline that re-encodes to GIF) could trigger this corruption.",
  "discovered_at": "2025-12-18T00:00:00+00:00",
  "location": null,
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "CGIF",
  "reproduction": null,
  "technical_details": "Root cause is an incomplete worst-case size formula: the buffer must hold at most 1 initial clear code + numPixel data codes + N reset clear codes + 1 termination code, but the N reset clear codes term was missing, so the malloc is undersized and subsequent code emission overruns it.",
  "title": "cgif/cgif_fuzzer/20251218_020844_unknown/",
  "vendor_severity": null
}