AppleVideoDecoder CreateHeaderBuffer Out-Of-Bounds Free
Posted by deepcore on May 13, 2022 – 6:06 am
AppleVideoDecoder suffers from an out-of-bounds free vulnerability. The attached video file contains a malformed HEVC Decoder Configuration Record that leads to an out-of-bounds free in CreateHeaderBuffer. When copying the VPS, PPS and SPS, the destination pointer is incremented, and if the copied data is larger than the length specified in the input file, it breaks and falls through to a condition that frees the destination pointer, even though it has been incremented. This could free the chunk allocated next to the destination memory.
Post a reply
You must be logged in to post a comment.