
Full Disclosure mailing list archives
libheif v1.21.0 Out-of-Bounds Read in Box_stts::get_sample_duration
From: Ron E <ronaldjedgerson () gmail com>
Date: Sat, 23 Aug 2025 10:17:45 -0400
The Box_stts structure defines decoding time to sample mapping. In Box_stts::get_sample_duration(unsigned), the requested index is assumed valid. A crafted file can set entry_count inconsistently with the actual buffer size, leading to access beyond the bounds of the parsed vector. *Root Cause:* - Lack of bounds checks on entry_count and indexing operations. - Blind trust in stts box metadata. *Impact:* - Invalid memory access → denial of service. - Information disclosure: reading adjacent heap contents may leak sensitive data. *Evidence:*SUMMARY: AddressSanitizer: SEGV in Box_stts::get_sample_duration(unsigned) _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Current thread:
- libheif v1.21.0 Out-of-Bounds Read in Box_stts::get_sample_duration Ron E (Sep 08)