libheif Buffer Overflow Vulnerability in SAO Processing Allows Arbitrary Code Execution

A buffer overflow vulnerability has been identified in libheif version 1.19.7. This vulnerability allows local attackers to execute arbitrary code by exploiting the Sample Adaptive Offset (SAO) processing in the libde265 library, which is used for HEIF/HEVC decoding. The issue arises from inadequate bounds checking when accessing the 'bandTable' array, leading to a stack buffer overflow during multi-threaded decoding.

Impact

Exploitation of this vulnerability causes a stack buffer overflow, which can lead to arbitrary code execution.

Reproduction

The vulnerability can be reproduced by using a crash file that contains malformed SAO parameters. This file can be processed with the 'heif_decode_image' function, using libheif's decoding interface. The stack buffer overflow occurs in the 'apply_sao_internal' function, specifically during multi-threaded decoding, when the improper SAO parameters are applied.