Heap-buffer-overflow in vlc_read_alf_coeff() --> davs2/source/common/alf.cc:389

[arayzw]

Describe the bug

=============================================================================================

static void vlc_read_alf_coeff(davs2_bs_t *bs, alf_param_t *alf_param)
{
const int numCoeff = ALF_MAX_NUM_COEF;
int f, symbol, pre_symbole;
int pos;

switch (alf_param->componentID) {
case IMG_U:
case IMG_V:
    for (pos = 0; pos < numCoeff; pos++) {
        alf_param->coeffmulti[0][pos] = se_v(bs, "Chroma ALF coefficients");
    }
    break;
case IMG_Y:
    alf_param->filters_per_group = ue_v(bs, "ALF filter number");
    alf_param->filters_per_group = alf_param->filters_per_group + 1;

    memset(alf_param->filterPattern, 0, ALF_NUM_VARS * sizeof(int));
    pre_symbole = 0;
    symbol = 0;
    for (f = 0; f < alf_param->filters_per_group; f++) {
        if (f > 0) {
            if (alf_param->filters_per_group != 16) {
                symbol = ue_v(bs, "Region distance");
            } else {
                symbol = 1;
            }
            alf_param->filterPattern[symbol + pre_symbole] = 1;
            pre_symbole += symbol;
        }

        for (pos = 0; pos < numCoeff; pos++) {
            alf_param->coeffmulti[f][pos] = se_v(bs, "Luma ALF coefficients");      //   <------  out of bounds here
        }
    }
    break;

=============================================================================================

To Reproduce

cd /path/to/davs2/build/linux/
./configure --enable-pic
vim config.mak (add -fsanitize=address to CFLAGS, and -fsanitize=address -lasan to LDFLAGS)
make
./davs2 -i /path/to/poc3 -o test.yuv

ASAN Crash log

=================================================================
==107031==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fb6ae012c3c at pc 0x5600c2dccb94 bp 0x7fffa1b502f0 sp 0x7fffa1b502e0
WRITE of size 4 at 0x7fb6ae012c3c thread T0
#0 0x5600c2dccb93 in vlc_read_alf_coeff /home/arayz/arayz/work/davs2/source/common/alf.cc:389
#1 0x5600c2dccb93 in davs2_alf_read_param /home/arayz/arayz/work/davs2/source/common/alf.cc:414
#2 0x5600c2d3772b in parse_picture_header_intra /home/arayz/arayz/work/davs2/source/common/header.cc:484
#3 0x5600c2d3772b in parse_picture_header /home/arayz/arayz/work/davs2/source/common/header.cc:705
#4 0x5600c2d3772b in davs2_parse_header /home/arayz/arayz/work/davs2/source/common/header.cc:1519
#5 0x5600c2d227e1 in decoder_decode_es_unit(davs2_mgr_t*, es_unit_t*) /home/arayz/arayz/work/davs2/source/common/davs2.cc:600
#6 0x5600c2d22fd9 in davs2_decoder_send_packet /home/arayz/arayz/work/davs2/source/common/davs2.cc:676
#7 0x5600c2d20698 in test_decoder /home/arayz/arayz/work/davs2/source/test/test.c:231
#8 0x5600c2d217bc in main /home/arayz/arayz/work/davs2/source/test/test.c:329
#9 0x7fb6c28e2082 in __libc_start_main ../csu/libc-start.c:308
#10 0x5600c2d1c52d in _start (/home/arayz/arayz/work/davs2/build/linux/davs2+0xc52d)

0x7fb6ae012c3d is located 0 bytes to the right of 3028029-byte region [0x7fb6add2f800,0x7fb6ae012c3d)
allocated by thread T0 here:
#0 0x7fb6c2f2c808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
#1 0x5600c2d295e9 in davs2_malloc /home/arayz/arayz/work/davs2/source/common/common.h:1240
#2 0x5600c2d295e9 in davs2_decoder_alloc_extra_buffer /home/arayz/arayz/work/davs2/source/common/decoder.cc:838
#3 0x7fb6bfb4f3bf ()

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/arayz/arayz/work/davs2/source/common/alf.cc:389 in vlc_read_alf_coeff
Shadow bytes around the buggy address:
0x0ff755bfa530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff755bfa540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff755bfa550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff755bfa560: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff755bfa570: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0ff755bfa580: 00 00 00 00 00 00 00[05]fa fa fa fa fa fa fa fa
0x0ff755bfa590: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0ff755bfa5a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0ff755bfa5b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0ff755bfa5c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0ff755bfa5d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==107031==ABORTING

Additional context

• OS: Ubuntu 22.04 (server)
• Compiler gcc version 11.2.0 (Ubuntu 11.2.0-19ubuntu1)

PoC:
poc3.zip