CVE-2026-32882: libheif堆缓冲区越界读取漏洞

/* * PoC Concept: Demonstrating the logic flaw in HeifPixelImage::overlay() * This C code snippet illustrates the indexing error where 'in_stride' is used * instead of 'alpha_stride' for the alpha plane. */ #include <stdio.h> #include <stdlib.h> #include <string.h> void vulnerable_overlay_logic(int width, int height, int color_stride, int alpha_stride, uint8_t* color_data, uint8_t* alpha_data) { // Simulate the vulnerable loop for (int y = 0; y < height; y++) { for (int x = 0; x < width; x++) { int color_idx = y * color_stride + x; // BUG: Using color_stride for alpha data indexing instead of alpha_stride // This causes out-of-bounds read if alpha_stride < color_stride int alpha_idx = y * color_stride + x; printf("Reading alpha at index %d (size: %d)\n", alpha_idx, width * height); // This would crash or leak memory in real scenario // uint8_t alpha_val = alpha_data[alpha_idx]; } } } int main() { // Example: 10-bit color (larger stride) vs 8-bit alpha (smaller stride) int w = 100, h = 50; int c_stride = 120; // Hypothetical color stride int a_stride = 100; // Hypothetical alpha stride (8-bit) uint8_t dummy_color[120*50]; uint8_t dummy_alpha[100*50]; // Smaller buffer // Trigger the vulnerable logic vulnerable_overlay_logic(w, h, c_stride, a_stride, dummy_color, dummy_alpha); return 0; }