Project: libheif (strukturag/libheif), language: c++
Vulnerability instance: libheif.cve-2023-29659
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/strukturag/libheif/issues/794
## Description:
Issue: strukturag/libheif#794
Title: FPE in box.cc - heif::Fraction::round()
State: closed
Created by: skensita
Created at: 2023-03-06 05:00:41+00:00

Issue Body:
**Tested version:**
libheif-1.15.1


**Description of the bug:**
Floating point exception is triggered when processing a crafted heif image, caused by divide by zero error, which leads to a crash.
This can be used for denial of service attacks.


**Steps to reproduce the bug:**
Compile with Address Sanitizer (ASan) :
./fuzzer ./poc.heif



**Address Sanitizer log:**
```
min@skensita:~/heif/fuzzer$ ./fuzzer dbg/classifiedCrashes/7e74fe547c83f1da6453572ddfe6832d1da6109c
AddressSanitizer:DEADLYSIGNAL
=================================================================
==8030==ERROR: AddressSanitizer: FPE on unknown address 0x55722e2d29ed (pc 0x55722e2d29ed bp 0x7ffebc2cd170 sp 0x7ffebc2cd160 T0)
    #0 0x55722e2d29ec in heif::Fraction::round() const (/home/min/heif/fuzzer/fuzzer+0x1189ec)
    #1 0x55722e2f32da in heif::Box_clap::bottom_rounded(int) const (/home/min/heif/fuzzer/fuzzer+0x1392da)
    #2 0x55722e22568c in heif::HeifContext::decode_image_planar(unsigned int, std::shared_ptr<heif::HeifPixelImage>&, heif_colorspace, heif_decoding_options const*, bool) const (/home/min/heif/fuzzer/fuzzer+0x6b68c)
    #3 0x55722e222609 in heif::HeifContext::decode_image_user(unsigned int, std::shared_ptr<heif::HeifPixelImage>&, heif_colorspace, heif_chroma, heif_decoding_options const*) const (/home/min/heif/fuzzer/fuzzer+0x68609)
    #4 0x55722e1dd8dc in heif_decode_image (/home/min/heif/fuzzer/fuzzer+0x238dc)
    #5 0x55722e1d46fa in TestDecodeImage(heif_context*, heif_image_handle const*) (/home/min/heif/fuzzer/fuzzer+0x1a6fa)
    #6 0x55722e1d4c4c in main (/home/min/heif/fuzzer/fuzzer+0x1ac4c)
    #7 0x7fed2bb83082 in __libc_start_main ../csu/libc-start.c:308
    #8 0x55722e1d42bd in _start (/home/min/heif/fuzzer/fuzzer+0x1a2bd)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE (/home/min/heif/fuzzer/fuzzer+0x1189ec) in heif::Fraction::round() const
==8030==ABORTING
```


Please check the attached POC.

[POC.zip](https://github.com/strukturag/libheif/files/10894604/POC.zip)


Comments:
Comment by farindk on 2023-03-06 13:34:17+00:00:
Thank you

---

Comment by skensita on 2023-03-06 13:38:42+00:00:
Can I get a CVE for this patch?

---

Comment by farindk on 2023-03-06 13:40:38+00:00:
I am not familiar with the CVE process. If you want, you can register it yourself.

---

Comment by skensita on 2023-03-06 13:41:50+00:00:
Thank you for quick response.

---

Comment by rathann on 2023-05-05 20:19:59+00:00:
FYI, this is CVE-2023-29659 (assigned by Red Hat).

---

Comment by karthik-pe on 2025-02-18 06:07:57+00:00:
I was trying to reproduce this vulnerability but I cannot find this `./fuzzer` binary anywhere. Can you please help me out here @skensita 

---

Comment by skensita on 2025-02-18 06:22:54+00:00:
> I was trying to reproduce this vulnerability but I cannot find this `./fuzzer` binary anywhere. Can you please help me out here [@skensita](https://github.com/skensita)

@karthik-pe 
 Please check the attached file. (POC.zip)
https://github.com/strukturag/libheif/issues/794#issue-1610666973

---

Comment by karthik-pe on 2025-02-18 09:26:06+00:00:
> > I was trying to reproduce this vulnerability but I cannot find this `./fuzzer` binary anywhere. Can you please help me out here [@skensita](https://github.com/skensita)
> 
> [@karthik-pe](https://github.com/karthik-pe) Please check the attached file. (POC.zip) [#794 (comment)](https://github.com/strukturag/libheif/issues/794#issue-1610666973)

Missed that, thank you

---

Comment by karthik-pe on 2025-02-24 08:54:27+00:00:
@skensita Did you build the box_fuzzer.cc for this?

Would it be possible for you give me the build instructions/steps?

Attachments:
https://github.com/strukturag/libheif/files/10894604/POC.zip

Commit References:
7e74fe547c83f1da6453572ddfe6832d1da6109c

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
export DEPS_PATH=$SRC/deps
mkdir -p $DEPS_PATH
cd $SRC/x265/build/linux
cmake -G "Unix Makefiles" \
    -DCMAKE_C_COMPILER=$CC -DCMAKE_CXX_COMPILER=$CXX \
    -DCMAKE_C_FLAGS="$CFLAGS" -DCMAKE_CXX_FLAGS="$CXXFLAGS" \
    -DCMAKE_INSTALL_PREFIX="$DEPS_PATH" \
    -DENABLE_SHARED:bool=off \
    ../../source
make clean -j$(nproc)
make -j$(nproc) x265-static
make install -j$(nproc)
cd $SRC/libde265
./autogen.sh
./configure \
    --prefix="$DEPS_PATH" \
    --disable-shared \
    --enable-static \
    --disable-dec265 \
    --disable-sherlock265 \
    --disable-hdrcopy \
    --disable-enc265 \
    --disable-acceleration_speed
make -j$(nproc)
mkdir -p $SRC/aom/build/linux
cd $SRC/aom/build/linux
  -DENABLE_SHARED:bool=off -DCONFIG_PIC=1 \
  -DENABLE_EXAMPLES=0 -DENABLE_DOCS=0 -DENABLE_TESTS=0 \
  -DCONFIG_SIZE_LIMIT=1 \
  -DDECODE_HEIGHT_LIMIT=12288 -DDECODE_WIDTH_LIMIT=12288 \
  -DDO_RANGE_CHECK_CLAMP=1 \
  -DAOM_MAX_ALLOCABLE_MEMORY=536870912 \
  -DAOM_TARGET_CPU=generic \
  ../../
cd $SRC/libheif
PKG_CONFIG="pkg-config --static" PKG_CONFIG_PATH="$DEPS_PATH/lib/pkgconfig" ./configure \
    --disable-examples \
    --disable-go \
    --enable-libfuzzer="$LIB_FUZZING_ENGINE" \
    CPPFLAGS="-I$DEPS_PATH/include"

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y autoconf automake build-essential cmake libtool make mercurial pkg-config yasm
RUN git clone https://github.com/strukturag/libheif libheif
RUN git -C libheif checkout 06f6acfe735379b9c3bcf865285f6dba80611e90
WORKDIR $SRC/libheif
COPY build.sh $SRC/

Additional files: