CVE-2021-31317

An attacker sends a malicious animated sticker (Lottie JSON) to a Telegram user. When the victim's Telegram client renders the sticker, the rlottie library parses the JSON and eventually calls `VGradientCache::generateGradientColorTable`. The attacker controls the `curr->first` float value in the gradient stop data, which determines how many times the loop writes to `colorTable[pos]`. Because `pos` is never checked against the fixed buffer size, the loop writes 4 bytes (an ARGB color value) past the end of the heap-allocated `colorTable` array. The written bytes are constrained by the `premulARGB()` encoding but are ultimately derived from attacker-supplied sticker content [ref_id=1].

The vulnerability is in the `VGradientCache::generateGradientColorTable` function within `rlottie/src/vector/vdrawhelper.cpp`. The `colorTable` array is a fixed-size (1024) heap buffer, but the loop writes to `colorTable[pos]` without checking that `pos` remains below `size` (the array length). The loop condition depends on the attacker-controlled float `curr->first`, which can cause many iterations beyond the buffer boundary [ref_id=1].

The advisory does not include a patch diff, but states that Telegram fixed the issue in client versions released September–October 2020: Telegram Android v7.1.0 (2090), Telegram iOS v7.1, and Telegram macOS v7.1 [ref_id=1]. The researcher notes that the root cause is an unbounded loop where `pos` is not checked against `size` (the `colorTable` array length). The fix likely adds a bounds check on `pos` before writing to `colorTable[pos]`, or limits the loop iterations based on `size` [ref_id=1].