Posted by Ron E on Sep 08
The Track::init_sample_timing_table logic manages a
std::vector<std::shared_ptr<Chunk>> representing parsed sequence chunks.
With malformed HEIF sequence files, corrupted chunk tables may cause
premature destruction of Chunk objects while references remain in the
vector. Later accesses via std::__shared_ptr<Chunk>::get() return a
dangling pointer.
ASan reports these as heap-buffer-overflows because the stale pointer still…
– Read More – Full Disclosure
