decoding.c in android-gif-drawable before 1.2.24 does not limit the maximum length of comment,leading to denial of service
tubeuchiha opened this issue · 2 comments
tubeuchiha commented
What are the impact surfaces by comment length ?
koral-- commented
Look at the https://nvd.nist.gov/vuln/detail/CVE-2022-23435
koral-- commented
Parsing a GIF file in the native code of the android-gif-drawable library causes a timeout, resulting in the hosting application using CPU and becoming unresponsive.
Impact: An attacker can send a malicious GIF file to any application that uses the android-gif-drawable library, causing the app to become unresponsive until it is killed.