aui-framework / aui-framework/aui
The vendored "gifdec" dependency is problematic
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 600
- Forks
- 44
- Avg merge
- 17h 56m
- Merged PRs (30d)
- 3
Description
In reviewing https://github.com/microsoft/vcpkg/pull/53142 to add aui-framework to vcpkg, GPT 5.6 Sol flags that a vendored copy of https://github.com/lecram/gifdec is present in the sources here. https://github.com/lecram/gifdec has 4 year old filed probably exploitable memory corruption bugs e.g. https://github.com/lecram/gifdec/pull/23
It's possible that there is no acceptable library under license terms aui-framework can use, but if that's the case there should probably be an explicit knob, build system or otherwise, to not include the problematic gif parser(s).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the vendored gifdec sources and their CMake integration, then review upstream gifdec pull request 23 and the vcpkg context for affected behavior and licensing constraints. Done means the vulnerable parser is removed or safely replaceable, or an explicit build option disables it, with the resulting configuration documented and validated.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cmake, cpp
- Domain
- build-system, desktop, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100