### Description
Stack-buffer-overflow (/libde265/build/libde265/liblibde265.so+0x19337f) in void apply_sao_internal<unsigned short>(de265_image*, int, int, slice_segment_header const*, int, int, int, unsigned short const*, int, unsigned short*, int)

### Version

```shell
$ ./dec265 -h
 dec265  v1.0.8
--------------
usage: dec265 [options] videofile.bin
The video file must be a raw bitstream, or a stream with NAL units (option -n).

options:
  -q, --quiet       do not show decoded image
  -t, --threads N   set number of worker threads (0 - no threading)
  -c, --check-hash  perform hash check
  -n, --nal         input is a stream with 4-byte length prefixed NAL units
  -f, --frames N    set number of frames to process
  -o, --output      write YUV reconstruction
  -d, --dump        dump headers
  -0, --noaccel     do not use any accelerated code (SSE)
  -v, --verbose     increase verbosity level (up to 3 times)
  -L, --no-logging  disable logging
  -B, --write-bytestream FILENAME  write raw bytestream (from NAL input)
  -m, --measure YUV compute PSNRs relative to reference YUV
  -T, --highest-TID select highest temporal sublayer to decode
      --disable-deblocking   disable deblocking filter
      --disable-sao          disable sample-adaptive offset filter
  -h, --help        show help
```



### Replay

```shell
git clone https://github.com/strukturag/libde265.git
cd libde265
mkdir build
cd build
cmake ../ -DCMAKE_CXX_FLAGS="-fsanitize=address"
make -j$(nproc)
./dec265/dec265 poc16
```

### ASAN

```Shell
WARNING: end_of_sub_stream_one_bit not set to 1 when it should be
WARNING: non-existing PPS referenced
WARNING: non-existing PPS referenced
=================================================================
==38055==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff34a96b44 at pc 0x7f62be643380 bp 0x7fff34a96550 sp 0x7fff34a96540
READ of size 4 at 0x7fff34a96b44 thread T0
    #0 0x7f62be64337f in void apply_sao_internal<unsigned short>(de265_image*, int, int, slice_segment_header const*, int, int, int, unsigned short const*, int, unsigned short*, int) (/libde265/build/libde265/liblibde265.so+0x19337f)
    #1 0x7f62be6413b6 in void apply_sao<unsigned char>(de265_image*, int, int, slice_segment_header const*, int, int, int, unsigned char const*, int, unsigned char*, int) (/libde265/build/libde265/liblibde265.so+0x1913b6)
    #2 0x7f62be63f761 in apply_sample_adaptive_offset_sequential(de265_image*) (/libde265/build/libde265/liblibde265.so+0x18f761)
    #3 0x7f62be5cda5d in decoder_context::run_postprocessing_filters_sequential(de265_image*) (/libde265/build/libde265/liblibde265.so+0x11da5d)
    #4 0x7f62be5c4ecf in decoder_context::decode_some(bool*) (/libde265/build/libde265/liblibde265.so+0x114ecf)
    #5 0x7f62be5c493d in decoder_context::read_slice_NAL(bitreader&, NAL_unit*, nal_header&) (/libde265/build/libde265/liblibde265.so+0x11493d)
    #6 0x7f62be5c743e in decoder_context::decode_NAL(NAL_unit*) (/libde265/build/libde265/liblibde265.so+0x11743e)
    #7 0x7f62be5c7ab3 in decoder_context::decode(int*) (/libde265/build/libde265/liblibde265.so+0x117ab3)
    #8 0x7f62be5aee95 in de265_decode (/libde265/build/libde265/liblibde265.so+0xfee95)
    #9 0x563cdef44bc9 in main (/libde265/build/dec265/dec265+0x6bc9)
    #10 0x7f62be0e0c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
    #11 0x563cdef429b9 in _start (/libde265/build/dec265/dec265+0x49b9)

Address 0x7fff34a96b44 is located in stack of thread T0 at offset 308 in frame
    #0 0x7f62be5c3e8b in decoder_context::read_slice_NAL(bitreader&, NAL_unit*, nal_header&) (/libde265/build/libde265/liblibde265.so+0x113e8b)

  This frame has 5 object(s):
    [32, 33) 'continueDecoding'
    [96, 97) 'did_work'
    [160, 164) 'err'
    [224, 232) 'imgunit'
    [288, 296) 'sliceunit' <== Memory access at offset 308 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow (/libde265/build/libde265/liblibde265.so+0x19337f) in void apply_sao_internal<unsigned short>(de265_image*, int, int, slice_segment_header const*, int, int, int, unsigned short const*, int, unsigned short*, int)
Shadow bytes around the buggy address:
  0x10006694ad10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006694ad20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006694ad30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006694ad40: 00 00 f1 f1 f1 f1 01 f2 f2 f2 f2 f2 f2 f2 01 f2
  0x10006694ad50: f2 f2 f2 f2 f2 f2 04 f2 f2 f2 f2 f2 f2 f2 00 f2
=>0x10006694ad60: f2 f2 f2 f2 f2 f2 f8 f2[f2]f2 00 00 00 00 00 00
  0x10006694ad70: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 03 f2
  0x10006694ad80: f2 f2 f2 f2 f2 f2 00 00 00 00 f3 f3 f3 f3 00 00
  0x10006694ad90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006694ada0: f1 f1 f1 f1 01 f2 f2 f2 00 00 00 00 00 00 00 00
  0x10006694adb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==38055==ABORTING
```

### POC

https://github.com/FDU-Sec/poc/blob/main/libde265/poc16

### Environment

```shell
Ubuntu 18.04.5 LTS
Clang 10.0.1
gcc 7.5.0
```

### Credit

Peng Deng ([Fudan University](https://secsys.fudan.edu.cn))
Stack-buffer-overflow in sao.cc:248: void apply_sao_internal<unsigned short>
This is a GitHub Issue
repo:libde265
owner:strukturag
Title : Stack-buffer-overflow in sao.cc:248: void apply_sao_internal<unsigned short>
Issue date:

--- start body ---
### Description
Stack-buffer-overflow (/libde265/build/libde265/liblibde265.so+0x19337f) in void apply_sao_internal<unsigned short>(de265_image*, int, int, slice_segment_header const*, int, int, int, unsigned short const*, int, unsigned short*, int)

### Version

```shell
$ ./dec265 -h
 dec265  v1.0.8
--------------
usage: dec265 [options] videofile.bin
The video file must be a raw bitstream, or a stream with NAL units (option -n).

options:
  -q, --quiet       do not show decoded image
  -t, --threads N   set number of worker threads (0 - no threading)
  -c, --check-hash  perform hash check
  -n, --nal         input is a stream with 4-byte length prefixed NAL units
  -f, --frames N    set number of frames to process
  -o, --output      write YUV reconstruction
  -d, --dump        dump headers
  -0, --noaccel     do not use any accelerated code (SSE)
  -v, --verbose     increase verbosity level (up to 3 times)
  -L, --no-logging  disable logging
  -B, --write-bytestream FILENAME  write raw bytestream (from NAL input)
  -m, --measure YUV compute PSNRs relative to reference YUV
  -T, --highest-TID select highest temporal sublayer to decode
      --disable-deblocking   disable deblocking filter
      --disable-sao          disable sample-adaptive offset filter
  -h, --help        show help
```



### Replay

```shell
git clone https://github.com/strukturag/libde265.git
cd libde265
mkdir build
cd build
cmake ../ -DCMAKE_CXX_FLAGS="-fsanitize=address"
make -j$(nproc)
./dec265/dec265 poc16
```

### ASAN

```Shell
WARNING: end_of_sub_stream_one_bit not set to 1 when it should be
WARNING: non-existing PPS referenced
WARNING: non-existing PPS referenced
=================================================================
==38055==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff34a96b44 at pc 0x7f62be643380 bp 0x7fff34a96550 sp 0x7fff34a96540
READ of size 4 at 0x7fff34a96b44 thread T0
    #0 0x7f62be64337f in void apply_sao_internal<unsigned short>(de265_image*, int, int, slice_segment_header const*, int, int, int, unsigned short const*, int, unsigned short*, int) (/libde265/build/libde265/liblibde265.so+0x19337f)
    #1 0x7f62be6413b6 in void apply_sao<unsigned char>(de265_image*, int, int, slice_segment_header const*, int, int, int, unsigned char const*, int, unsigned char*, int) (/libde265/build/libde265/liblibde265.so+0x1913b6)
    #2 0x7f62be63f761 in apply_sample_adaptive_offset_sequential(de265_image*) (/libde265/build/libde265/liblibde265.so+0x18f761)
    #3 0x7f62be5cda5d in decoder_context::run_postprocessing_filters_sequential(de265_image*) (/libde265/build/libde265/liblibde265.so+0x11da5d)
    #4 0x7f62be5c4ecf in decoder_context::decode_some(bool*) (/libde265/build/libde265/liblibde265.so+0x114ecf)
    #5 0x7f62be5c493d in decoder_context::read_slice_NAL(bitreader&, NAL_unit*, nal_header&) (/libde265/build/libde265/liblibde265.so+0x11493d)
    #6 0x7f62be5c743e in decoder_context::decode_NAL(NAL_unit*) (/libde265/build/libde265/liblibde265.so+0x11743e)
    #7 0x7f62be5c7ab3 in decoder_context::decode(int*) (/libde265/build/libde265/liblibde265.so+0x117ab3)
    #8 0x7f62be5aee95 in de265_decode (/libde265/build/libde265/liblibde265.so+0xfee95)
    #9 0x563cdef44bc9 in main (/libde265/build/dec265/dec265+0x6bc9)
    #10 0x7f62be0e0c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
    #11 0x563cdef429b9 in _start (/libde265/build/dec265/dec265+0x49b9)

Address 0x7fff34a96b44 is located in stack of thread T0 at offset 308 in frame
    #0 0x7f62be5c3e8b in decoder_context::read_slice_NAL(bitreader&, NAL_unit*, nal_header&) (/libde265/build/libde265/liblibde265.so+0x113e8b)

  This frame has 5 object(s):
    [32, 33) 'continueDecoding'
    [96, 97) 'did_work'
    [160, 164) 'err'
    [224, 232) 'imgunit'
    [288, 296) 'sliceunit' <== Memory access at offset 308 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow (/libde265/build/libde265/liblibde265.so+0x19337f) in void apply_sao_internal<unsigned short>(de265_image*, int, int, slice_segment_header const*, int, int, int, unsigned short const*, int, unsigned short*, int)
Shadow bytes around the buggy address:
  0x10006694ad10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006694ad20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006694ad30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006694ad40: 00 00 f1 f1 f1 f1 01 f2 f2 f2 f2 f2 f2 f2 01 f2
  0x10006694ad50: f2 f2 f2 f2 f2 f2 04 f2 f2 f2 f2 f2 f2 f2 00 f2
=>0x10006694ad60: f2 f2 f2 f2 f2 f2 f8 f2[f2]f2 00 00 00 00 00 00
  0x10006694ad70: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 03 f2
  0x10006694ad80: f2 f2 f2 f2 f2 f2 00 00 00 00 f3 f3 f3 f3 00 00
  0x10006694ad90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006694ada0: f1 f1 f1 f1 01 f2 f2 f2 00 00 00 00 00 00 00 00
  0x10006694adb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==38055==ABORTING
```

### POC

https://github.com/FDU-Sec/poc/blob/main/libde265/poc16

### Environment

```shell
Ubuntu 18.04.5 LTS
Clang 10.0.1
gcc 7.5.0
```

### Credit

Peng Deng ([Fudan University](https://secsys.fudan.edu.cn))
--- end body ---

A stack buffer overflow vulnerability exists in the `apply_sao_internal` function of the libde265 library, specifically in version 1.0.8. This vulnerability can be exploited by providing specially crafted input to the decoder, leading to potential arbitrary code execution or denial of service due to the stack corruption.