libde265 1.0.8, was discovered to contain a heap-use-after-free in put_qpel_fallback

[salmonx]

Description

libde265 1.0.8, was discovered to contain a heap-use-after-free in put_qpel_fallback (fallback-motion.cc)

ENV

Version : 1.0.8 Commit : 45904e5667c5bf59c67fcdc586dfba110832894c OS : Ubuntu 18.04 Configure : cmake -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=clang++-10 -DCMAKE_CXX_FLAGS="-fsanitize=address" ../

BT

➜  build git:(master) ✗ ./dec265 crash-eebb3b06a97086193e0f1fc9c0328a4a
WARNING: non-existing PPS referenced
WARNING: non-existing PPS referenced
WARNING: end_of_sub_stream_one_bit not set to 1 when it should be
WARNING: CTB outside of image area (concealing stream error...)
WARNING: CTB outside of image area (concealing stream error...)
WARNING: faulty reference picture list
WARNING: CTB outside of image area (concealing stream error...)
WARNING: CTB outside of image area (concealing stream error...)
WARNING: CTB outside of image area (concealing stream error...)
WARNING: CTB outside of image area (concealing stream error...)
WARNING: CTB outside of image area (concealing stream error...)
WARNING: coded parameter out of range
WARNING: CTB outside of image area (concealing stream error...)
WARNING: short-term ref-pic-set index out of range
WARNING: CTB outside of image area (concealing stream error...)
SPS error: TB > CB
=================================================================
==71626==ERROR: AddressSanitizer: heap-use-after-free on address 0x62a000026420 at pc 0x7f19626d52eb bp 0x7ffdf2508940 sp 0x7ffdf2508938
READ of size 2 at 0x62a000026420 thread T0
    #0 0x7f19626d52ea in void put_qpel_fallback<unsigned short>(short*, long, unsigned short const*, long, int, int, short*, int, int, int) /work/fuzz/soft/libde265-master/libde265/fallback-motion.cc:532:16
    #1 0x7f19626ce47a in put_qpel_2_1_fallback_16(short*, long, unsigned short const*, long, int, int, short*, int) /work/fuzz/soft/libde265-master/libde265/fallback-motion.cc:647:13
    #2 0x7f196271be1b in acceleration_functions::put_hevc_qpel(short*, long, void const*, long, int, int, short*, int, int, int) const /work/fuzz/soft/libde265-master/libde265/acceleration.h:338:5
    #3 0x7f196271834b in void mc_luma<unsigned short>(base_context const*, seq_parameter_set const*, int, int, int, int, short*, int, unsigned short const*, int, int, int, int) /work/fuzz/soft/libde265-master/libde265/motion.cc:156:23
    #4 0x7f19627042cd in generate_inter_prediction_samples(base_context*, slice_segment_header const*, de265_image*, int, int, int, int, int, int, int, PBMotion const*) /work/fuzz/soft/libde265-master/libde265/motion.cc:367:11
    #5 0x7f19627173d4 in decode_prediction_unit(base_context*, slice_segment_header const*, de265_image*, PBMotionCoding const&, int, int, int, int, int, int, int, int) /work/fuzz/soft/libde265-master/libde265/motion.cc:2107:3
    #6 0x7f196276d11d in read_prediction_unit(thread_context*, int, int, int, int, int, int, int, int, int) /work/fuzz/soft/libde265-master/libde265/slice.cc:4136:3
    #7 0x7f196276f699 in read_coding_unit(thread_context*, int, int, int, int) /work/fuzz/soft/libde265-master/libde265/slice.cc:4517:9
    #8 0x7f1962763d8f in read_coding_quadtree(thread_context*, int, int, int, int) /work/fuzz/soft/libde265-master/libde265/slice.cc:4652:5
    #9 0x7f1962763d5e in read_coding_quadtree(thread_context*, int, int, int, int) /work/fuzz/soft/libde265-master/libde265/slice.cc:4645:7
    #10 0x7f1962763af0 in read_coding_quadtree(thread_context*, int, int, int, int) /work/fuzz/soft/libde265-master/libde265/slice.cc:4635:5
    #11 0x7f1962763504 in read_coding_tree_unit(thread_context*) /work/fuzz/soft/libde265-master/libde265/slice.cc:2861:3
    #12 0x7f1962771a1c in decode_substream(thread_context*, bool, bool) /work/fuzz/soft/libde265-master/libde265/slice.cc:4741:5
    #13 0x7f1962774350 in read_slice_segment_data(thread_context*) /work/fuzz/soft/libde265-master/libde265/slice.cc:5054:14
    #14 0x7f196268347c in decoder_context::decode_slice_unit_sequential(image_unit*, slice_unit*) /work/fuzz/soft/libde265-master/libde265/decctx.cc:852:7
    #15 0x7f196268212b in decoder_context::decode_slice_unit_parallel(image_unit*, slice_unit*) /work/fuzz/soft/libde265-master/libde265/decctx.cc:954:11
    #16 0x7f1962681533 in decoder_context::decode_some(bool*) /work/fuzz/soft/libde265-master/libde265/decctx.cc:739:13
    #17 0x7f196267f866 in decoder_context::read_slice_NAL(bitreader&, NAL_unit*, nal_header&) /work/fuzz/soft/libde265-master/libde265/decctx.cc:697:9
    #18 0x7f1962685548 in decoder_context::decode_NAL(NAL_unit*) /work/fuzz/soft/libde265-master/libde265/decctx.cc:1239:11
    #19 0x7f1962685e9e in decoder_context::decode(int*) /work/fuzz/soft/libde265-master/libde265/decctx.cc:1327:16
    #20 0x7f196265ad74 in de265_decode /work/fuzz/soft/libde265-master/libde265/de265.cc:352:15
    #21 0x4c8e84 in main /work/fuzz/soft/libde265-master/dec265/dec265.cc:764:17
    #22 0x7f1961226c86 in __libc_start_main /build/glibc-uZu3wS/glibc-2.27/csu/../csu/libc-start.c:310
    #23 0x41c4e9 in _start (/work/fuzz/soft/libde265-master/build_debug/dec265/dec265+0x41c4e9)

0x62a000026420 is located 8736 bytes inside of 20480-byte region [0x62a000024200,0x62a000029200)
freed by thread T0 here:
    #0 0x4c4cfd in operator delete[](void*) (/work/fuzz/soft/libde265-master/build_debug/dec265/dec265+0x4c4cfd)
    #1 0x7f196273c4be in apply_sample_adaptive_offset_sequential(de265_image*) /work/fuzz/soft/libde265-master/libde265/sao.cc:378:3
    #2 0x7f1962682649 in decoder_context::run_postprocessing_filters_sequential(de265_image*) /work/fuzz/soft/libde265-master/libde265/decctx.cc:1898:7
    #3 0x7f19626818c1 in decoder_context::decode_some(bool*) /work/fuzz/soft/libde265-master/libde265/decctx.cc:778:7
    #4 0x7f196267f866 in decoder_context::read_slice_NAL(bitreader&, NAL_unit*, nal_header&) /work/fuzz/soft/libde265-master/libde265/decctx.cc:697:9
    #5 0x7f1962685548 in decoder_context::decode_NAL(NAL_unit*) /work/fuzz/soft/libde265-master/libde265/decctx.cc:1239:11
    #6 0x7f1962685e9e in decoder_context::decode(int*) /work/fuzz/soft/libde265-master/libde265/decctx.cc:1327:16
    #7 0x7f196265ad74 in de265_decode /work/fuzz/soft/libde265-master/libde265/de265.cc:352:15
    #8 0x4c8e84 in main /work/fuzz/soft/libde265-master/dec265/dec265.cc:764:17
    #9 0x7f1961226c86 in __libc_start_main /build/glibc-uZu3wS/glibc-2.27/csu/../csu/libc-start.c:310

previously allocated by thread T0 here:
    #0 0x4c44ad in operator new[](unsigned long) (/work/fuzz/soft/libde265-master/build_debug/dec265/dec265+0x4c44ad)
    #1 0x7f196273bbff in apply_sample_adaptive_offset_sequential(de265_image*) /work/fuzz/soft/libde265-master/libde265/sao.cc:335:24
    #2 0x7f1962682649 in decoder_context::run_postprocessing_filters_sequential(de265_image*) /work/fuzz/soft/libde265-master/libde265/decctx.cc:1898:7
    #3 0x7f19626818c1 in decoder_context::decode_some(bool*) /work/fuzz/soft/libde265-master/libde265/decctx.cc:778:7
    #4 0x7f196267f866 in decoder_context::read_slice_NAL(bitreader&, NAL_unit*, nal_header&) /work/fuzz/soft/libde265-master/libde265/decctx.cc:697:9
    #5 0x7f1962685548 in decoder_context::decode_NAL(NAL_unit*) /work/fuzz/soft/libde265-master/libde265/decctx.cc:1239:11
    #6 0x7f1962685e9e in decoder_context::decode(int*) /work/fuzz/soft/libde265-master/libde265/decctx.cc:1327:16
    #7 0x7f196265ad74 in de265_decode /work/fuzz/soft/libde265-master/libde265/de265.cc:352:15
    #8 0x4c8e84 in main /work/fuzz/soft/libde265-master/dec265/dec265.cc:764:17
    #9 0x7f1961226c86 in __libc_start_main /build/glibc-uZu3wS/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-use-after-free /work/fuzz/soft/libde265-master/libde265/fallback-motion.cc:532:16 in void put_qpel_fallback<unsigned short>(short*, long, unsigned short const*, long, int, int, short*, int, int, int)
Shadow bytes around the buggy address:
  0x0c547fffcc30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c547fffcc40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c547fffcc50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c547fffcc60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c547fffcc70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c547fffcc80: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
  0x0c547fffcc90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c547fffcca0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c547fffccb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c547fffccc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c547fffccd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==71626==ABORTING

Reported on Apr 11th 2022 https://huntr.dev/bounties/e7b0da8a-14df-447c-be2f-6a7301f78e0e/