dyne / frei0r

A large collection of free and portable video plugins
https://frei0r.dyne.org/
GNU General Public License v2.0
419 stars 91 forks source link

heap buffer overflow in filter curves #156

Closed jaromil closed 1 year ago

jaromil commented 1 year ago

{ "name":"Curves", "type":"filter", "color_model":"rgba8888", "num_params":"16" }================================================================= ==4639==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000ad34 at pc 0x7fd451f7531f bp 0x7ffcbd128650 sp 0x7ffcbd128648 READ of size 4 at 0x60200000ad34 thread T0

0 0x7fd451f7531e in f0r_update /home/jrml/frei0r/build/../src/filter/curves/curves.c:958:14

#1 0x4ce10b in main /home/jrml/frei0r/test/frei0r-test.c:148:2
#2 0x7fd468bb9d09 in __libc_start_main csu/../csu/libc-start.c:308:16
#3 0x420819 in _start (/home/jrml/frei0r/test/frei0r-test+0x420819)

0x60200000ad34 is located 0 bytes to the right of 4-byte region [0x60200000ad30,0x60200000ad34) allocated by thread T0 here:

0 0x49a88d in malloc (/home/jrml/frei0r/test/frei0r-test+0x49a88d)

#1 0x7fd451f6ae38 in f0r_construct /home/jrml/frei0r/build/../src/filter/curves/curves.c:260:20
#2 0x4cdb61 in main /home/jrml/frei0r/test/frei0r-test.c:126:14
#3 0x7fd468bb9d09 in __libc_start_main csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/jrml/frei0r/build/../src/filter/curves/curves.c:958:14 in f0r_update

Merlimau commented 1 year ago

Probably related to this commit: https://github.com/dyne/frei0r/commit/04ac1c58b7efad8f0308515a6099dc66136b8150