Posted by Ron E on Sep 08
Box_hdlr::get_handler_type() (libheif/box.h:487) is called even when the
hdlr box has not been properly initialized due to malformed input. This
leads to dereferencing a null object pointer.
*Root Cause:*
–
No validation of hdlr box presence before accessing handler fields.
*Impact:*
–
Application crash only (DoS).
–
No memory corruption or exploitability.
*Evidence:*==2436988==ERROR: AddressSanitizer: SEGV on unknown…
– Read More – Full Disclosure
