strukturag libde265 Segmentation Fault Vulnerability in Frame Drop Table Computation

A segmentation fault vulnerability has been identified in strukturag libde265, specifically in commit d9fea9d. The issue arises within the 'decoder_context::compute_framedrop_table()' function, leading to a buffer overflow.

Impact

Exploitation of this vulnerability causes a segmentation fault, indicating a buffer overflow condition.

Reproduction

The vulnerability can be reproduced by compiling libde265 with AddressSanitizer enabled, using Clang as the compiler. After building the application, the 'dec265' tool can be run with a command-line argument that triggers the vulnerability, such as an invalid value for the 'T' parameter. This causes the application to attempt to access memory incorrectly, resulting in a segmentation fault.

Remediation

Users are advised to update to the latest version of libde265, where this vulnerability has been addressed.