Security Advisories (1)
CVE-2026-112202 (2026-10-20)

Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected. The same code ships bundled in the Imager distribution. An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.

NAME

Imager::Expr::Assem - an assembler for producing code for the Imager
register machine

SYNOPSIS

use Imager::Expr::Assem;
my $expr = Imager::Expr->new(assem=>'...', ...)

DESCRIPTION

This module is a simple Imager::Expr compiler that compiles a low-level language that has a nearly 1-to-1 relationship to the internal representation used for compiled register machine code.

Syntax

Each line can contain multiple statements separated by semi-colons.

Anything after '#' in a line is ignored.

Types of statements:

variable definition

var name:type

defines variable name to have type, which can be any of n or num for a numeric type or pixel, p or c for a pixel or color type.

Variable names cannot include white-space.

operators

Operators can be split into 3 basic types, those that have a result value, those that don't and the null operator, eg. jump has no value.

The format for operators that return a value is typically:

result = operator operand ...

and for those that don't return a value:

operator operand

where operator is any valid register machine operator, result is any variable defined with var, and operands are variables, constants or literals, or for jump operators, labels.

The set operator can be simplified to:

result = operator

All operators maybe preceded by a label, which is any non-white-space text immediately followed by a colon (':').

BUGS

Note that the current optimizer may produce incorrect optimization for your code, fortunately the optimizer will disable itself if you include any jump operator in your code. A single jump to anywhere after your final ret operator can be used to disable the optimizer without slowing down your code.

There's currently no high-level code generation that can generate code with loops or real conditions.

SEE ALSO

Imager(3), transform.perl, regmach.c

AUTHOR

Tony Cook <tony@develop-help.com>