- Reported
-
- Issued
-
- Package
-
heifer-isobmff
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#heif
#heic
#isobmff
#memory-exhaustion
- Aliases
-
- References
-
- CVSS Score
- 6.5
MEDIUM
- CVSS Details
-
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- Scope
- Unchanged
- Confidentiality Impact
- None
- Integrity Impact
- None
- Availability Impact
- High
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- Patched
-
Description
heifer-isobmff read the item and extent counts of the iloc box (item
locations) from the file and allocated memory for them before checking that the
box was large enough to hold that many entries. Extents that declare no field at
all take zero bytes each, so a small crafted file could declare an enormous
number of them. A 42 KB file made parsing allocate several gigabytes, which can
exhaust memory and abort the process.
Any application that parses untrusted HEIF/HEIC files with heifer-isobmff,
directly or through the heifer crate, is affected: HeifFile::parse and every
decoding and metadata function built on it.
The flaw was corrected in 0.3.27 (commit
1a8426e):
item and extent counts are bounded by the size of the box, extents that carry no
field are rejected, and the total number of extents is capped.
Advisory available under CC0-1.0
license.