commit 061605081115bbfd7019bafc119a13b6f17fcf25
Author: Anthony Hurtado <amhurtado@protonmail.com>
Date:   Mon Jun 1 15:40:48 2026 -0500

    Fix CVE-2026-26740: heap OOB write in EGifGCBToSavedExtension
    
    EGifGCBToSavedExtension calls EGifGCBToExtension which unconditionally
    writes 4 bytes into ep->Bytes without checking ep->ByteCount.  If the
    extension block was allocated with fewer than 4 bytes, this results in
    a heap buffer overflow.
    
    The read-side counterpart DGifExtensionToGCB already validates that
    GifExtensionLength == 4 before reading.  Add the symmetric check on
    the write side: return GIF_ERROR when ep->ByteCount < 4.
    
    Signed-off-by: Anthony Hurtado <amhurtado@pm.me>

diff --git egif_lib.c egif_lib.c
index f1141a2..d74e8df 100644
--- egif_lib.c
+++ egif_lib.c
@@ -690,6 +690,9 @@ int EGifGCBToSavedExtension(const GraphicsControlBlock *GCB,
 		ExtensionBlock *ep =
 		    &GifFile->SavedImages[ImageIndex].ExtensionBlocks[i];
 		if (ep->Function == GRAPHICS_EXT_FUNC_CODE) {
+			if (ep->ByteCount < 4) {
+				return GIF_ERROR;
+			}
 			EGifGCBToExtension(GCB, ep->Bytes);
 			return GIF_OK;
 		}