CVE-2022-43240 - Heap Buffer Overflow Vulnerability in libde265 v1..8

In the fast-evolving field of video processing, the libde265 library stands out as a key open-source implementation of the HEVC (aka H.265) video codec. However, in late 2022, a significant vulnerability was discovered in libde265 v1..8: CVE-2022-43240, a heap buffer overflow located within the SSE-optimized motion compensation function. Attackers can exploit this flaw with a specially crafted video file, potentially causing a denial-of-service (DoS) attack against any application processing such content.

This article explains the vulnerability’s root cause, provides a practical demonstration, and suggests mitigation strategies. We give you an exclusive, step-by-step breakdown, easy to understand—even if you’re not an expert coder.

Trigger: Crafted video file

- Found by: huntr

References

- Official Advisory on huntr.dev
- NIST NVD Entry
- libde265 project page

How Does Heap Buffer Overflow Occur?

A heap buffer overflow happens when a program writes more data to a buffer located on the heap (a region of memory used for dynamic allocations) than what is originally allocated. This can overwrite adjacent memory and can crash the program, corrupt data, or—if an attacker is lucky—take control of the target process.

In libde265 v1..8, the function

void ff_hevc_put_hevc_qpel_h_2_v_1_sse(uint8_t *dst, ptrdiff_t dststride, uint8_t *src, ptrdiff_t srcstride, int height, int mx, int my)

—located in sse-motion.cc—performs motion compensation using SIMD SSE instructions, copying blocks of image data during decoding.

The issue: When fed a video file with specific (malicious) parameters, the function calculates positions or buffer sizes incorrectly, leading it to copy data outside the limits of the heap-allocated region.

Minimal Proof-of-Concept

The following C program uses libde265 to decode a malicious video file designed to trigger the vulnerability. (Do not use this for malicious purposes; this is for educational use only!)

#include <libde265/de265.h>
#include <stdio.h>

int main(int argc, char* argv[]) {
    if (argc < 2) {
        printf("Usage: %s <malicious_video.hevc>\n", argv[]);
        return 1;
    }
    de265_decoder_context* ctx = de265_new_decoder();
    FILE* f = fopen(argv[1], "rb");
    if (!f) {
        perror("File open error");
        return 1;
    }
    uint8_t buf[4096];
    while (!feof(f)) {
        size_t n = fread(buf, 1, sizeof(buf), f);
        de265_push_NAL(ctx, buf, n, , , );
        de265_decode(ctx, NULL);
    }
    fclose(f);
    de265_free_decoder(ctx);
    return ;
}

Malicious Video

Creating the malicious video file involves tampering with encoding parameters to overflow the buffer—specific details have been shared in the huntr advisory. They supply a tiny crafted .hevc file that crashes the decoder due to the improper buffer checks.

What happens?
On decoding this crafted file, the vulnerable function overruns the heap buffer, leading to a segmentation fault, and the process crashes:

!Example Crash Output:

Output

* buffer overflow detected *: terminated
Aborted (core dumped)

Let’s look at a snippet of the vulnerable function (simplified, for illustration)

void ff_hevc_put_hevc_qpel_h_2_v_1_sse(
    uint8_t *dst, ptrdiff_t dststride,
    uint8_t *src, ptrdiff_t srcstride,
    int height, int mx, int my)
{
    // ...
    // SIMD-accelerated copy block, vulnerable logic here
    for (int y = ; y < height; y++) {
        __m128i data = _mm_loadu_si128((__m128i *)(src + /* offset based on mx/my */));
        // Do processing ...
        _mm_storeu_si128((__m128i *)(dst + y*dststride), data); // Dst overflow if height or stride is wrong
    }
}

The issue is that with crafted height, mx, my, and other codec parameters embedded in a malicious video, the computed address for dst or src can point outside the allocated buffer, leading to memory corruption.

What can an attacker do?

- Trigger an Application Crash: Attackers can exploit this error to make any app/process using vulnerable libde265 crash via specially crafted videos. This is, practically, a *Denial of Service (DoS)*.
- (Potential) Code Execution: While the current PoCs only show DoS, with good heap grooming and luck, an expert might be able to achieve code execution (as is known with other heap buffer overflows). But so far, only stability and security of apps are at immediate risk.

Video players (e.g., mpv with libhevc, VLC with certain libraries)

- Video gateways/servers doing automated transcoding or previewing

Fix and Mitigation

Status:
- The affected code was patched following the disclosure. The fix adds stricter bounds-checking and safe buffer management.

How to stay safe:

Conclusion

CVE-2022-43240 is a practical reminder: multimedia code, written for performance, is especially vulnerable to subtle memory bugs. If unpatched, this bug lets attackers crash any process that decodes their crafted video file with libde265. While it has not yet escalated into a public code execution exploit, the risk remains significant.

Mitigate now by patching libde265, and stay aware of the dangers of memory unsafe programming, especially in code exposed to untrusted inputs.

Timeline

Published on: 11/02/2022 14:15:00 UTC
Last modified on: 02/27/2023 15:24:00 UTC

CVE-2022-43240 - Heap Buffer Overflow Vulnerability in libde265 v1..8 – Exploit Analysis and Guide