libde265
libde265 copied to clipboard
Fix out of bounds memory read in apply_sao_internal
This PR fixes out of bounds memory read in apply_sao_internal revealed by fuzzing kimageformats: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31485
There are two issues:
-
saoOffsetVal
is defined asint8_t saoOffsetVal[3][4];
. WhenbandIdx
is larger than4
it leads to out of bounds memory read. -
bandTable
is defined asint bandTable[32]
. Whenin_img[xC+i+(yC+j)*in_stride]>>bandShift
results in > 31 it leads to out of bounds memory read.