Project: libheif (strukturag/libheif), language: c++
Vulnerability instance: libheif.cve-2020-19498
Sanitizer: undefined

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/strukturag/libheif/issues/139
## Description:
Issue: strukturag/libheif#139
Title: Floating point exception
State: closed
Created by: strongcourage
Created at: 2019-07-28 10:14:30+00:00

Issue Body:
Hi,

I found a FPE bug on the latest commit fd0c01d on master.
PoC: https://github.com/strongcourage/PoCs/blob/master/libheif_fd0c01d/PoC_fpe_box.cc:62
Command: examples/heif-info $PoC
Valgrind says:
~~~
==1112== Process terminating with default action of signal 8 (SIGFPE)
==1112==  Integer divide by zero at address 0x80362AC81
==1112==    at 0x528354: Fraction (box.cc:62)
==1112==    by 0x528354: operator- (box.cc:100)
==1112==    by 0x528354: heif::Box_clap::get_height_rounded() const (box.cc:2263)
==1112==    by 0x48F697: heif::HeifContext::interpret_heif_file() (heif_context.cc:696)
==1112==    by 0x49A40A: heif::HeifContext::read_from_file(char const*) (heif_context.cc:351)
==1112==    by 0x40859F: heif_context_read_from_file (heif.cc:184)
==1112==    by 0x404290: main (heif_info.cc:145)
Floating point exception
~~~
Thanks,
Manh Dung


Comments:
Comment by fancycode on 2019-08-02 12:58:10+00:00:
@farindk Could you please take a look? The same probably applies to the other `XXX_rounded` methods in `Box_clap`.

---

Comment by farindk on 2019-08-02 14:43:37+00:00:
Thanks for this very strange edge case :-)
Fixed in 5c3dff7cdeff



---

Comment by fancycode on 2019-08-02 14:57:46+00:00:
No longer crashes but now triggers an undefined behavior error (unfortunately not more output):
```
box.cc:123:43: runtime error: signed integer overflow: -2147483647 * 2 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior box.cc:123:43 in
```

---

Comment by farindk on 2019-08-02 15:41:14+00:00:
Let's just limit the resolution of the Fractions to get around all of these numeric edge cases:
2710c93091860


---

Comment by fgeek on 2021-07-26 15:05:00+00:00:
CVE-2020-19498 has been assigned for this issue.

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
export DEPS_PATH=$SRC/deps
mkdir -p $DEPS_PATH
cd $SRC/x265/build/linux
cmake -G "Unix Makefiles" \
    -DCMAKE_C_COMPILER=$CC -DCMAKE_CXX_COMPILER=$CXX \
    -DCMAKE_C_FLAGS="$CFLAGS" -DCMAKE_CXX_FLAGS="$CXXFLAGS" \
    -DCMAKE_INSTALL_PREFIX="$DEPS_PATH" \
    -DENABLE_SHARED:bool=off \
    ../../source
make clean -j$(nproc)
make -j$(nproc) x265-static
make install -j$(nproc)
cd $SRC/libde265
./autogen.sh
./configure \
    --prefix="$DEPS_PATH" \
    --disable-shared \
    --enable-static \
    --disable-dec265 \
    --disable-sherlock265 \
    --disable-hdrcopy \
    --disable-enc265 \
    --disable-acceleration_speed
make -j$(nproc)
cd $SRC/libheif
PKG_CONFIG="pkg-config --static" PKG_CONFIG_PATH="$DEPS_PATH/lib/pkgconfig" ./configure \
    --disable-examples \
    --disable-go \
    --enable-libfuzzer

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y autoconf automake build-essential cmake libtool make mercurial pkg-config yasm
RUN git clone https://github.com/strukturag/libheif libheif
RUN git -C libheif checkout 444b24ce51b73afedd8e0d31b71867be3433d9fc
WORKDIR $SRC/libheif
COPY build.sh $SRC/

Additional files: