CVE-2021-40812

Vulnerability

The GD Graphics Library (LibGD) through version 2.3.2 contains an out-of-bounds read flaw due to missing return value checks on gdPutBuf and gdGetBuf calls [2]. In gd_bmp.c, the functions _gdImageBmpCtx at lines 269 and 328 call gdPutBuf without verifying that the number of bytes written matches the expected size [1][2]. Similar unchecked calls exist in gd_webp.c and gd_gif_out.c [2]. The lack of validation allows an attacker to supply crafted image data that causes a short write, leading to an out-of-bounds read when subsequent operations rely on the assumed buffer length.

Exploitation

An attacker must supply a specially crafted BMP file (or other affected format) to an application using the vulnerable LibGD version [2]. The attacker does not need authentication if the application accepts user-uploaded images. When the library writes the processed image data via gdPutBuf, the unchecked return value allows the code to continue with a partially written buffer. This results in reading memory beyond the intended buffer boundaries [1][2].

Impact

Successful exploitation results in an out-of-bounds read, potentially disclosing sensitive information from adjacent memory. The vulnerability does not directly allow arbitrary code execution, but memory disclosure can aid further attacks. No privilege escalation is achieved; the impact is limited to information disclosure within the context of the process using the library [2].

Mitigation

The fix was committed in commit 6f5136821be86e7068fcdf651ae9420b5d42e9a9 [1], which adds return value checks for gdPutBuf in _gdImageBmpCtx and ensures proper error handling [1]. This commit was merged into the master branch and should be included in releases after 2.3.2. Users should update to a patched version of LibGD. No workarounds are documented; any application using LibGD to process untrusted image data should apply the patch.