### Description

heap-buffer-overflow `libde265/libde265/motion.cc:1719` in `derive_spatial_luma_vector_prediction(base_context*, de265_image*, slice_segment_header const*, int, int, int, int, int, int, int, int, int, int, unsigned char*, MotionVector*)`

### Version

```
 dec265  v1.0.14
-----------------
usage: dec265 [options] videofile.bin
The video file must be a raw bitstream, or a stream with NAL units (option -n).

options:
  -q, --quiet       do not show decoded image
  -t, --threads N   set number of worker threads (0 - no threading)
  -c, --check-hash  perform hash check
  -n, --nal         input is a stream with 4-byte length prefixed NAL units
  -f, --frames N    set number of frames to process
  -o, --output      write YUV reconstruction
  -d, --dump        dump headers
  -0, --noaccel     do not use any accelerated code (SSE)
  -v, --verbose     increase verbosity level (up to 3 times)
  -L, --no-logging  disable logging
  -B, --write-bytestream FILENAME  write raw bytestream (from NAL input)
  -m, --measure YUV compute PSNRs relative to reference YUV
  -T, --highest-TID select highest temporal sublayer to decode
      --disable-deblocking   disable deblocking filter
      --disable-sao          disable sample-adaptive offset filter
  -h, --help        show help
```

### Replay

```
cd libde265
CC="gcc -fsanitize=address" CXX="g++ -fsanitize=address" ./configure
make -j

# You need to try running poc several times to see the asan result.
./dec265/dec265 ./poc
```

### ASAN

```
==3280661==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61b00000d860 at pc 0x557206ed8a9d bp 0x7ffc7a17d230 sp 0x7ffc7a17d220
READ of size 4 at 0x61b00000d860 thread T0
    #0 0x557206ed8a9c in derive_spatial_luma_vector_prediction(base_context*, de265_image*, slice_segment_header const*, int, int, int, int, int, int, int, int, int, int, unsigned char*, MotionVector*) libde265/libde265/motion.cc:1719
    #1 0x557206ed9950 in fill_luma_motion_vector_predictors(base_context*, slice_segment_header const*, de265_image*, int, int, int, int, int, int, int, int, int, int, MotionVector*) libde265/libde265/motion.cc:1990
    #2 0x557206eee58a in luma_motion_vector_prediction(base_context*, slice_segment_header const*, de265_image*, PBMotionCoding const&, int, int, int, int, int, int, int, int, int, int) libde265/libde265/motion.cc:2063
    #3 0x557206eee58a in motion_vectors_and_ref_indices(base_context*, slice_segment_header const*, de265_image*, PBMotionCoding const&, int, int, int, int, int, int, int, int, PBMotion*) libde265/libde265/motion.cc:2155
    #4 0x557206eee58a in decode_prediction_unit(base_context*, slice_segment_header const*, de265_image*, PBMotionCoding const&, int, int, int, int, int, int, int, int) libde265/libde265/motion.cc:2195
    #5 0x557206db4806 in read_prediction_unit(thread_context*, int, int, int, int, int, int, int, int, int) libde265/libde265/slice.cc:4145
    #6 0x557206dbe5ff in read_coding_unit(thread_context*, int, int, int, int) libde265/libde265/slice.cc:4513
    #7 0x557206dc5696 in decode_substream(thread_context*, bool, bool) libde265/libde265/slice.cc:4750
    #8 0x557206dcbfc9 in read_slice_segment_data(thread_context*) libde265/libde265/slice.cc:5063
    #9 0x557206c8e8b4 in decoder_context::decode_slice_unit_sequential(image_unit*, slice_unit*) libde265/libde265/decctx.cc:854
    #10 0x557206c95e55 in decoder_context::decode_slice_unit_parallel(image_unit*, slice_unit*) libde265/libde265/decctx.cc:956
    #11 0x557206c997eb in decoder_context::decode_some(bool*) libde265/libde265/decctx.cc:741
    #12 0x557206cab57a in decoder_context::read_slice_NAL(bitreader&, NAL_unit*, nal_header&) libde265/libde265/decctx.cc:699
    #13 0x557206cad645 in decoder_context::decode_NAL(NAL_unit*) libde265/libde265/decctx.cc:1241
    #14 0x557206cae508 in decoder_context::decode(int*) libde265/libde265/decctx.cc:1329
    #15 0x557206c6846c in main libde265/dec265/dec265.cc:784
    #16 0x7f14f9029d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #17 0x7f14f9029e3f in __libc_start_main_impl ../csu/libc-start.c:392
    #18 0x557206c6ace4 in _start (eva/asan-bin/NestFuzz/libde265/dec265+0x1ece4)

0x61b00000d860 is located 88 bytes to the right of 1416-byte region [0x61b00000d280,0x61b00000d808)
allocated by thread T0 here:
    #0 0x7f14f98b61e7 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:99
    #1 0x557206ca9f17 in decoder_context::read_slice_NAL(bitreader&, NAL_unit*, nal_header&) libde265/libde265/decctx.cc:635

SUMMARY: AddressSanitizer: heap-buffer-overflow libde265/libde265/motion.cc:1719 in derive_spatial_luma_vector_prediction(base_context*, de265_image*, slice_segment_header const*, int, int, int, int, int, int, int, int, int, int, unsigned char*, MotionVector*)
```

### POC

[poc](https://github.com/fdu-sec/poc/raw/main/libde265/poc21)

### Environment

```
Description:	Ubuntu 22.04.2 LTS
gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0
```

### Credit

Yuchuan Meng ([Fudan University](https://secsys.fudan.edu.cn/))
heap-buffer-overflow `libde265/libde265/motion.cc:1719` in `derive_spatial_luma_vector_prediction`
This is a GitHub Issue
repo:libde265
owner:strukturag
Title : heap-buffer-overflow `libde265/libde265/motion.cc:1719` in `derive_spatial_luma_vector_prediction`
Issue date:

--- start body ---
### Description

heap-buffer-overflow `libde265/libde265/motion.cc:1719` in `derive_spatial_luma_vector_prediction(base_context*, de265_image*, slice_segment_header const*, int, int, int, int, int, int, int, int, int, int, unsigned char*, MotionVector*)`

### Version

```
 dec265  v1.0.14
-----------------
usage: dec265 [options] videofile.bin
The video file must be a raw bitstream, or a stream with NAL units (option -n).

options:
  -q, --quiet       do not show decoded image
  -t, --threads N   set number of worker threads (0 - no threading)
  -c, --check-hash  perform hash check
  -n, --nal         input is a stream with 4-byte length prefixed NAL units
  -f, --frames N    set number of frames to process
  -o, --output      write YUV reconstruction
  -d, --dump        dump headers
  -0, --noaccel     do not use any accelerated code (SSE)
  -v, --verbose     increase verbosity level (up to 3 times)
  -L, --no-logging  disable logging
  -B, --write-bytestream FILENAME  write raw bytestream (from NAL input)
  -m, --measure YUV compute PSNRs relative to reference YUV
  -T, --highest-TID select highest temporal sublayer to decode
      --disable-deblocking   disable deblocking filter
      --disable-sao          disable sample-adaptive offset filter
  -h, --help        show help
```

### Replay

```
cd libde265
CC="gcc -fsanitize=address" CXX="g++ -fsanitize=address" ./configure
make -j

# You need to try running poc several times to see the asan result.
./dec265/dec265 ./poc
```

### ASAN

```
==3280661==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61b00000d860 at pc 0x557206ed8a9d bp 0x7ffc7a17d230 sp 0x7ffc7a17d220
READ of size 4 at 0x61b00000d860 thread T0
    #0 0x557206ed8a9c in derive_spatial_luma_vector_prediction(base_context*, de265_image*, slice_segment_header const*, int, int, int, int, int, int, int, int, int, int, unsigned char*, MotionVector*) libde265/libde265/motion.cc:1719
    #1 0x557206ed9950 in fill_luma_motion_vector_predictors(base_context*, slice_segment_header const*, de265_image*, int, int, int, int, int, int, int, int, int, int, MotionVector*) libde265/libde265/motion.cc:1990
    #2 0x557206eee58a in luma_motion_vector_prediction(base_context*, slice_segment_header const*, de265_image*, PBMotionCoding const&, int, int, int, int, int, int, int, int, int, int) libde265/libde265/motion.cc:2063
    #3 0x557206eee58a in motion_vectors_and_ref_indices(base_context*, slice_segment_header const*, de265_image*, PBMotionCoding const&, int, int, int, int, int, int, int, int, PBMotion*) libde265/libde265/motion.cc:2155
    #4 0x557206eee58a in decode_prediction_unit(base_context*, slice_segment_header const*, de265_image*, PBMotionCoding const&, int, int, int, int, int, int, int, int) libde265/libde265/motion.cc:2195
    #5 0x557206db4806 in read_prediction_unit(thread_context*, int, int, int, int, int, int, int, int, int) libde265/libde265/slice.cc:4145
    #6 0x557206dbe5ff in read_coding_unit(thread_context*, int, int, int, int) libde265/libde265/slice.cc:4513
    #7 0x557206dc5696 in decode_substream(thread_context*, bool, bool) libde265/libde265/slice.cc:4750
    #8 0x557206dcbfc9 in read_slice_segment_data(thread_context*) libde265/libde265/slice.cc:5063
    #9 0x557206c8e8b4 in decoder_context::decode_slice_unit_sequential(image_unit*, slice_unit*) libde265/libde265/decctx.cc:854
    #10 0x557206c95e55 in decoder_context::decode_slice_unit_parallel(image_unit*, slice_unit*) libde265/libde265/decctx.cc:956
    #11 0x557206c997eb in decoder_context::decode_some(bool*) libde265/libde265/decctx.cc:741
    #12 0x557206cab57a in decoder_context::read_slice_NAL(bitreader&, NAL_unit*, nal_header&) libde265/libde265/decctx.cc:699
    #13 0x557206cad645 in decoder_context::decode_NAL(NAL_unit*) libde265/libde265/decctx.cc:1241
    #14 0x557206cae508 in decoder_context::decode(int*) libde265/libde265/decctx.cc:1329
    #15 0x557206c6846c in main libde265/dec265/dec265.cc:784
    #16 0x7f14f9029d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #17 0x7f14f9029e3f in __libc_start_main_impl ../csu/libc-start.c:392
    #18 0x557206c6ace4 in _start (eva/asan-bin/NestFuzz/libde265/dec265+0x1ece4)

0x61b00000d860 is located 88 bytes to the right of 1416-byte region [0x61b00000d280,0x61b00000d808)
allocated by thread T0 here:
    #0 0x7f14f98b61e7 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:99
    #1 0x557206ca9f17 in decoder_context::read_slice_NAL(bitreader&, NAL_unit*, nal_header&) libde265/libde265/decctx.cc:635

SUMMARY: AddressSanitizer: heap-buffer-overflow libde265/libde265/motion.cc:1719 in derive_spatial_luma_vector_prediction(base_context*, de265_image*, slice_segment_header const*, int, int, int, int, int, int, int, int, int, int, unsigned char*, MotionVector*)
```

### POC

[poc](https://github.com/fdu-sec/poc/raw/main/libde265/poc21)

### Environment

```
Description:	Ubuntu 22.04.2 LTS
gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0
```

### Credit

Yuchuan Meng ([Fudan University](https://secsys.fudan.edu.cn/))
--- end body ---

A heap-buffer-overflow vulnerability in the `derive_spatial_luma_vector_prediction` function of libde265 v1.0.14 can lead to potential memory corruption and application crashes when processing specially crafted video files. This issue is triggered by improper handling of memory allocation, allowing an attacker to exploit the overflow and potentially execute arbitrary code or cause a Denial of Service (DoS).