- Reported
-
- Issued
-
- Package
-
heifer-hevc-dec
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#hevc
#h265
#heic
#panic
- Aliases
-
- References
-
- CVSS Score
- 6.5
MEDIUM
- CVSS Details
-
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- Scope
- Unchanged
- Confidentiality Impact
- None
- Integrity Impact
- None
- Availability Impact
- High
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- Patched
-
Description
An HEVC picture parameter set (PPS) stores explicit tile column widths and row
heights computed against the sequence parameter set (SPS) active when it was
parsed. A crafted stream can redefine that SPS afterwards, so that the tile sizes
add up to more than the picture. The decoder then indexed past its coding tree
block tables: Rust's bounds checks turned this into a panic, or the picture was
decoded wrongly. A panic aborts the decoding thread, or the whole process when
built with panic = "abort". The crate forbids unsafe code, so there is no
memory corruption.
Any application that decodes untrusted HEIC files or HEVC streams with
heifer-hevc-dec, directly or through the heifer crate, is affected.
The flaw was corrected in 0.3.27 (commit
71dfc67):
a tile layout that does not match the picture size is rejected with
Error::Invalid at decode time.
Advisory available under CC0-1.0
license.