I have found one stack buffer overflow in fallback-motion.c with fuzzing. Following is the call stack:

> ==9741==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffea6393b31 at pc 0x7f22eec1a2a0 bp 0x7ffea6391050 sp 0x7ffea6391048
> READ of size 2 at 0x7ffea6393b31 thread T0
>     #0 0x7f22eec1a29f in void put_epel_hv_fallback<unsigned short>(short*, long, unsigned short const*, long, int, int, int, int, short*, int) /home/appsadm/libde265/libde265/fallback-motion.cc:348:19
>     #1 0x7f22eed0d1fc in acceleration_functions::put_hevc_epel_v(short*, long, void const*, long, int, int, int, int, short*, int) const /home/appsadm/libde265/libde265/../libde265/acceleration.h
>     #2 0x7f22eed08fbd in void mc_chroma<unsigned char>(base_context const*, seq_parameter_set const*, int, int, int, int, short*, int, unsigned char const*, int, int, int, int) /home/appsadm/libde265/libde265/motion.cc:264:25
>     #3 0x7f22eecc4f74 in generate_inter_prediction_samples(base_context*, slice_segment_header const*, de265_image*, int, int, int, int, int, int, int, PBMotion const*) /home/appsadm/libde265/libde265/motion.cc:388:11
>     #4 0x7f22eecfae55 in decode_prediction_unit(base_context*, slice_segment_header const*, de265_image*, PBMotionCoding const&, int, int, int, int, int, int, int, int) /home/appsadm/libde265/libde265/motion.cc:2107:3
>     #5 0x7f22eedfa02c in read_prediction_unit(thread_context*, int, int, int, int, int, int, int, int, int) /home/appsadm/libde265/libde265/slice.cc:4136:3
>     #6 0x7f22eedfddec in read_coding_unit(thread_context*, int, int, int, int) /home/appsadm/libde265/libde265/slice.cc:4504:9
>     #7 0x7f22eeddab51 in read_coding_quadtree(thread_context*, int, int, int, int) /home/appsadm/libde265/libde265/slice.cc:4652:5
>     #8 0x7f22eedd85fb in read_coding_tree_unit(thread_context*) /home/appsadm/libde265/libde265/slice.cc:2861:3
>     #9 0x7f22eee096db in decode_substream(thread_context*, bool, bool) /home/appsadm/libde265/libde265/slice.cc:4741:5
>     #10 0x7f22eee14dab in read_slice_segment_data(thread_context*) /home/appsadm/libde265/libde265/slice.cc:5054:14
>     #11 0x7f22eeb4ebd0 in decoder_context::decode_slice_unit_sequential(image_unit*, slice_unit*) /home/appsadm/libde265/libde265/decctx.cc:843:7
>     #12 0x7f22eeb49b15 in decoder_context::decode_slice_unit_parallel(image_unit*, slice_unit*) /home/appsadm/libde265/libde265/decctx.cc:945:11

can send POC over email. Please let me know.
Stack buffer overflow in fallback-motion.c
This is a GitHub Issue
repo:libde265
owner:strukturag
Title : Stack buffer overflow in fallback-motion.c
Issue date:

--- start body ---
I have found one stack buffer overflow in fallback-motion.c with fuzzing. Following is the call stack:

> ==9741==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffea6393b31 at pc 0x7f22eec1a2a0 bp 0x7ffea6391050 sp 0x7ffea6391048
> READ of size 2 at 0x7ffea6393b31 thread T0
>     #0 0x7f22eec1a29f in void put_epel_hv_fallback<unsigned short>(short*, long, unsigned short const*, long, int, int, int, int, short*, int) /home/appsadm/libde265/libde265/fallback-motion.cc:348:19
>     #1 0x7f22eed0d1fc in acceleration_functions::put_hevc_epel_v(short*, long, void const*, long, int, int, int, int, short*, int) const /home/appsadm/libde265/libde265/../libde265/acceleration.h
>     #2 0x7f22eed08fbd in void mc_chroma<unsigned char>(base_context const*, seq_parameter_set const*, int, int, int, int, short*, int, unsigned char const*, int, int, int, int) /home/appsadm/libde265/libde265/motion.cc:264:25
>     #3 0x7f22eecc4f74 in generate_inter_prediction_samples(base_context*, slice_segment_header const*, de265_image*, int, int, int, int, int, int, int, PBMotion const*) /home/appsadm/libde265/libde265/motion.cc:388:11
>     #4 0x7f22eecfae55 in decode_prediction_unit(base_context*, slice_segment_header const*, de265_image*, PBMotionCoding const&, int, int, int, int, int, int, int, int) /home/appsadm/libde265/libde265/motion.cc:2107:3
>     #5 0x7f22eedfa02c in read_prediction_unit(thread_context*, int, int, int, int, int, int, int, int, int) /home/appsadm/libde265/libde265/slice.cc:4136:3
>     #6 0x7f22eedfddec in read_coding_unit(thread_context*, int, int, int, int) /home/appsadm/libde265/libde265/slice.cc:4504:9
>     #7 0x7f22eeddab51 in read_coding_quadtree(thread_context*, int, int, int, int) /home/appsadm/libde265/libde265/slice.cc:4652:5
>     #8 0x7f22eedd85fb in read_coding_tree_unit(thread_context*) /home/appsadm/libde265/libde265/slice.cc:2861:3
>     #9 0x7f22eee096db in decode_substream(thread_context*, bool, bool) /home/appsadm/libde265/libde265/slice.cc:4741:5
>     #10 0x7f22eee14dab in read_slice_segment_data(thread_context*) /home/appsadm/libde265/libde265/slice.cc:5054:14
>     #11 0x7f22eeb4ebd0 in decoder_context::decode_slice_unit_sequential(image_unit*, slice_unit*) /home/appsadm/libde265/libde265/decctx.cc:843:7
>     #12 0x7f22eeb49b15 in decoder_context::decode_slice_unit_parallel(image_unit*, slice_unit*) /home/appsadm/libde265/libde265/decctx.cc:945:11

can send POC over email. Please let me know.
--- end body ---

A stack buffer overflow vulnerability in the fallback-motion.c file of libde265 can be exploited through crafted input, potentially leading to arbitrary code execution or application crashes. The issue is triggered during the execution of the put_epel_hv_fallback function, which indicates that the program does not properly validate the size of the input data before processing it, allowing for a buffer overflow.