Heap buffer overflow due to vulnerability in heif-forked lib

[Nalen98]

Greetings.
I researched this repo and crafted the malformed input which leads to crash (heap buffer overflow) at BitStream::extract(int, int, BitStream&) in lib/heif/Srcs/common/bitstream.cpp:109.

PoC: PoC.zip

Triggered by:

./tifig -v -p PoC.heic out.jpg
Segmentation fault

ASAN report:

$ ./tifig -v -p PoC.heic out.jpg
==717167==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x617000000da5 at pc 0x7fe3cb86d480 bp 0x7ffe8b6eb1a0 sp 0x7ffe8b6ea948
READ of size 1453 at 0x617000000da5 thread T0
    #0 0x7fe3cb86d47f  (/lib/x86_64-linux-gnu/libasan.so.5+0x9b47f)
    #1 0x5608d69b92fd in unsigned char* std::__copy_move<false, true, std::random_access_iterator_tag>::__copy_m<unsigned char>(unsigned char const*, unsigned char const*, unsigned char*) /usr/include/c++/9/bits/stl_algobase.h:386
    #2 0x5608d69b92fd in unsigned char* std::__copy_move_a<false, unsigned char const*, unsigned char*>(unsigned char const*, unsigned char const*, unsigned char*) /usr/include/c++/9/bits/stl_algobase.h:404
    #3 0x5608d69b92fd in unsigned char* std::__copy_move_a2<false, __gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, unsigned char*>(__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, __gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, unsigned char*) /usr/include/c++/9/bits/stl_algobase.h:440
    #4 0x5608d69b92fd in unsigned char* std::copy<__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, unsigned char*>(__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, __gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, unsigned char*) /usr/include/c++/9/bits/stl_algobase.h:474
    #5 0x5608d69b92fd in unsigned char* std::__uninitialized_copy<true>::__uninit_copy<__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, unsigned char*>(__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, __gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, unsigned char*) /usr/include/c++/9/bits/stl_uninitialized.h:101
    #6 0x5608d69b92fd in unsigned char* std::uninitialized_copy<__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, unsigned char*>(__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, __gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, unsigned char*) /usr/include/c++/9/bits/stl_uninitialized.h:140
    #7 0x5608d69b92fd in unsigned char* std::__uninitialized_copy_a<__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, unsigned char*, unsigned char>(__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, __gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, unsigned char*, std::allocator<unsigned char>&) /usr/include/c++/9/bits/stl_uninitialized.h:307
    #8 0x5608d69b92fd in void std::vector<unsigned char, std::allocator<unsigned char> >::_M_range_insert<__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > > >(__gnu_cxx::__normal_iterator<unsigned char*, std::vector<unsigned char, std::allocator<unsigned char> > >, __gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, __gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, std::forward_iterator_tag) /usr/include/c++/9/bits/vector.tcc:778
    #9 0x5608d69b92fd in void std::vector<unsigned char, std::allocator<unsigned char> >::_M_insert_dispatch<__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > > >(__gnu_cxx::__normal_iterator<unsigned char*, std::vector<unsigned char, std::allocator<unsigned char> > >, __gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, __gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, std::__false_type) /usr/include/c++/9/bits/stl_vector.h:1662
    #10 0x5608d69b92fd in __gnu_cxx::__normal_iterator<unsigned char*, std::vector<unsigned char, std::allocator<unsigned char> > > std::vector<unsigned char, std::allocator<unsigned char> >::insert<__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, void>(__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, __gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, __gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >) /usr/include/c++/9/bits/stl_vector.h:1380
    #11 0x5608d69b92fd in BitStream::extract(int, int, BitStream&) const /home/nale/tifig-0.2.3/lib/heif/Srcs/common/bitstream.cpp:109
    #12 0x5608d69c7797 in BitStream::readSubBoxBitStream(FourCCInt&) /home/nale/tifig-0.2.3/lib/heif/Srcs/common/bitstream.cpp:404
    #13 0x5608d6a47d63 in ItemPropertiesBox::parseBox(BitStream&) /home/nale/tifig-0.2.3/lib/heif/Srcs/common/itempropertiesbox.cpp:120
    #14 0x5608d6a9f792 in MetaBox::parseBox(BitStream&) /home/nale/tifig-0.2.3/lib/heif/Srcs/common/metabox.cpp:250
    #15 0x5608d68ff9f4 in HevcImageFileReader::readStream() /home/nale/tifig-0.2.3/lib/heif/Srcs/reader/hevcimagefilereader.cpp:1119
    #16 0x5608d690bcc3 in HevcImageFileReader::initialize(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /home/nale/tifig-0.2.3/lib/heif/Srcs/reader/hevcimagefilereader.cpp:65
    #17 0x5608d66d2b74 in convert(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, Opts&) /home/nale/tifig-0.2.3/src/main.cpp:49
    #18 0x5608d66b98f7 in main /home/nale/tifig-0.2.3/src/main.cpp:179
    #19 0x7fe3c957b0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #20 0x5608d66c02cd in _start (/home/nale/tifig-0.2.3/build/tifig+0x5d2cd)

0x617000000da5 is located 0 bytes to the right of 677-byte region [0x617000000b00,0x617000000da5)
allocated by thread T0 here:
    #0 0x7fe3cb8e1947 in operator new(unsigned long) (/lib/x86_64-linux-gnu/libasan.so.5+0x10f947)
    #1 0x5608d69b925f in __gnu_cxx::new_allocator<unsigned char>::allocate(unsigned long, void const*) /usr/include/c++/9/ext/new_allocator.h:114
    #2 0x5608d69b925f in std::allocator_traits<std::allocator<unsigned char> >::allocate(std::allocator<unsigned char>&, unsigned long) /usr/include/c++/9/bits/alloc_traits.h:444
    #3 0x5608d69b925f in std::_Vector_base<unsigned char, std::allocator<unsigned char> >::_M_allocate(unsigned long) /usr/include/c++/9/bits/stl_vector.h:343
    #4 0x5608d69b925f in void std::vector<unsigned char, std::allocator<unsigned char> >::_M_range_insert<__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > > >(__gnu_cxx::__normal_iterator<unsigned char*, std::vector<unsigned char, std::allocator<unsigned char> > >, __gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, __gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, std::forward_iterator_tag) /usr/include/c++/9/bits/vector.tcc:769
    #5 0x5608d69b925f in void std::vector<unsigned char, std::allocator<unsigned char> >::_M_insert_dispatch<__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > > >(__gnu_cxx::__normal_iterator<unsigned char*, std::vector<unsigned char, std::allocator<unsigned char> > >, __gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, __gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, std::__false_type) /usr/include/c++/9/bits/stl_vector.h:1662
    #6 0x5608d69b925f in __gnu_cxx::__normal_iterator<unsigned char*, std::vector<unsigned char, std::allocator<unsigned char> > > std::vector<unsigned char, std::allocator<unsigned char> >::insert<__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, void>(__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, __gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >, __gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > >) /usr/include/c++/9/bits/stl_vector.h:1380
    #7 0x5608d69b925f in BitStream::extract(int, int, BitStream&) const /home/nale/tifig-0.2.3/lib/heif/Srcs/common/bitstream.cpp:109

SUMMARY: AddressSanitizer: heap-buffer-overflow (/lib/x86_64-linux-gnu/libasan.so.5+0x9b47f) 
Shadow bytes around the buggy address:
  0x0c2e7fff8160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fff8170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fff8180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fff8190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fff81a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c2e7fff81b0: 00 00 00 00[05]fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e7fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e7fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e7fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e7fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e7fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==717167==ABORTING

GDB info:

Your repo uses old version of heif lib, where BitStream::extract(int, int, BitStream&) in lib/heif/Srcs/common/bitstream.cpp:109 looks like:

void BitStream::extract(const int begin, const int end, BitStream& dest) const
{
    dest.clear();
    dest.reset();
    dest.mStorage.insert(dest.mStorage.begin(), mStorage.begin() + begin, mStorage.begin() + end); <-------This line is the source of heap buffer overflow in tifig
}

Just compare it with the latest version of the code in bitstream.cpp:

void BitStream::extract(const std::uint64_t begin, const std::uint64_t end, BitStream& dest) const
    {
        dest.clear();
        dest.reset();
        if (begin <= mStorage.size() && end <= mStorage.size() && begin <= end)
        {
            dest.mStorage.insert(dest.mStorage.begin(), mStorage.begin() + static_cast<std::int64_t>(begin),
                                 mStorage.begin() + static_cast<std::int64_t>(end));
        }
        else
        {
            throw RuntimeError("BitStream::readSubBoxBitStream trying to read 0 size box");
        }
    }

Environment:
Host Operating System and version: Ubuntu 20.04.2 LTS
Host CPU architecture: x86_64