- Reported
-
- Issued
-
- Package
-
heifer-hevc-dec
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#hevc
#h265
#heic
#panic
- Aliases
-
- References
-
- CVSS Score
- 6.5
MEDIUM
- CVSS Details
-
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- Scope
- Unchanged
- Confidentiality Impact
- None
- Integrity Impact
- None
- Availability Impact
- High
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- Patched
-
Description
An HEVC Range Extensions stream can set cu_chroma_qp_offset_enabled_flag in a
slice while its picture parameter set carries an empty chroma QP offset list.
The decoder then read the list at the signalled index, which panicked on the
out-of-range access. A panic aborts the decoding thread, or the whole process
when built with panic = "abort". The crate forbids unsafe code, so there is
no memory corruption.
Any application that decodes untrusted HEIC files or HEVC streams with
heifer-hevc-dec, directly or through the heifer crate, is affected.
The flaw was corrected in 0.3.27 (commit
1a8426e):
with an empty list there is no offset to apply, and the offset is zero.
Advisory available under CC0-1.0
license.