Beware: Libheif v1.21.0 Bug Could Crash Your App!
Libheif v1.21.0’s FullBox::get_flags method has a problem: it tries to read 24-bit flags without checking if there’s enough data. This results in a crash or potential memory leak. Remember, when it comes to code, it’s not about how much you read, but how safely you read it!
Hot Take:
Looks like libheif has been caught red-handed, trying to read its own fortune in the memory tea leaves! But instead of a prosperous future, all it found was a crash course in the dangers of out-of-bounds reading. Talk about a “full box” of surprises!
Key Points:
– The FullBox::get_flags() method in libheif v1.21.0 suffers from an out-of-bounds read vulnerability.
– The issue arises due to the lack of length validation when attempting to read 24-bit flags.
– This oversight can lead to crashes or potentially expose heap memory values.
– The problem is particularly tied to malformed box headers.
– AddressSanitizer has identified segmentation faults in the function.