### Description

heap-buffer-overflow `libde265/libde265/motion.cc:1719` in `derive_spatial_luma_vector_prediction(base_context*, de265_image*, slice_segment_header const*, int, int, int, int, int, int, int, int, int, int, unsigned char*, MotionVector*)`

### Version

```
 dec265  v1.0.14
-----------------
usage: dec265 [options] videofile.bin
The video file must be a raw bitstream, or a stream with NAL units (option -n).

options:
  -q, --quiet       do not show decoded image
  -t, --threads N   set number of worker threads (0 - no threading)
  -c, --check-hash  perform hash check
  -n, --nal         input is a stream with 4-byte length prefixed NAL units
  -f, --frames N    set number of frames to process
  -o, --output      write YUV reconstruction
  -d, --dump        dump headers
  -0, --noaccel     do not use any accelerated code (SSE)
  -v, --verbose     increase verbosity level (up to 3 times)
  -L, --no-logging  disable logging
  -B, --write-bytestream FILENAME  write raw bytestream (from NAL input)
  -m, --measure YUV compute PSNRs relative to reference YUV
  -T, --highest-TID select highest temporal sublayer to decode
      --disable-deblocking   disable deblocking filter
      --disable-sao          disable sample-adaptive offset filter
  -h, --help        show help
```

### Replay

```
cd libde265
CC="gcc -fsanitize=address" CXX="g++ -fsanitize=address" ./configure
make -j

# You need to try running poc several times to see the asan result.
./dec265/dec265 ./poc
```

### ASAN

```
==3280661==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61b00000d860 at pc 0x557206ed8a9d bp 0x7ffc7a17d230 sp 0x7ffc7a17d220
READ of size 4 at 0x61b00000d860 thread T0
    #0 0x557206ed8a9c in derive_spatial_luma_vector_prediction(base_context*, de265_image*, slice_segment_header const*, int, int, int, int, int, int, int, int, int, int, unsigned char*, MotionVector*) libde265/libde265/motion.cc:1719
    #1 0x557206ed9950 in fill_luma_motion_vector_predictors(base_context*, slice_segment_header const*, de265_image*, int, int, int, int, int, int, int, int, int, int, MotionVector*) libde265/libde265/motion.cc:1990
    #2 0x557206eee58a in luma_motion_vector_prediction(base_context*, slice_segment_header const*, de265_image*, PBMotionCoding const&, int, int, int, int, int, int, int, int, int, int) libde265/libde265/motion.cc:2063
    #3 0x557206eee58a in motion_vectors_and_ref_indices(base_context*, slice_segment_header const*, de265_image*, PBMotionCoding const&, int, int, int, int, int, int, int, int, PBMotion*) libde265/libde265/motion.cc:2155
    #4 0x557206eee58a in decode_prediction_unit(base_context*, slice_segment_header const*, de265_image*, PBMotionCoding const&, int, int, int, int, int, int, int, int) libde265/libde265/motion.cc:2195
    #5 0x557206db4806 in read_prediction_unit(thread_context*, int, int, int, int, int, int, int, int, int) libde265/libde265/slice.cc:4145
    #6 0x557206dbe5ff in read_coding_unit(thread_context*, int, int, int, int) libde265/libde265/slice.cc:4513
    #7 0x557206dc5696 in decode_substream(thread_context*, bool, bool) libde265/libde265/slice.cc:4750
    #8 0x557206dcbfc9 in read_slice_segment_data(thread_context*) libde265/libde265/slice.cc:5063
    #9 0x557206c8e8b4 in decoder_context::decode_slice_unit_sequential(image_unit*, slice_unit*) libde265/libde265/decctx.cc:854
    #10 0x557206c95e55 in decoder_context::decode_slice_unit_parallel(image_unit*, slice_unit*) libde265/libde265/decctx.cc:956
    #11 0x557206c997eb in decoder_context::decode_some(bool*) libde265/libde265/decctx.cc:741
    #12 0x557206cab57a in decoder_context::read_slice_NAL(bitreader&, NAL_unit*, nal_header&) libde265/libde265/decctx.cc:699
    #13 0x557206cad645 in decoder_context::decode_NAL(NAL_unit*) libde265/libde265/decctx.cc:1241
    #14 0x557206cae508 in decoder_context::decode(int*) libde265/libde265/decctx.cc:1329
    #15 0x557206c6846c in main libde265/dec265/dec265.cc:784
    #16 0x7f14f9029d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #17 0x7f14f9029e3f in __libc_start_main_impl ../csu/libc-start.c:392
    #18 0x557206c6ace4 in _start (eva/asan-bin/NestFuzz/libde265/dec265+0x1ece4)

0x61b00000d860 is located 88 bytes to the right of 1416-byte region [0x61b00000d280,0x61b00000d808)
allocated by thread T0 here:
    #0 0x7f14f98b61e7 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:99
    #1 0x557206ca9f17 in decoder_context::read_slice_NAL(bitreader&, NAL_unit*, nal_header&) libde265/libde265/decctx.cc:635

SUMMARY: AddressSanitizer: heap-buffer-overflow libde265/libde265/motion.cc:1719 in derive_spatial_luma_vector_prediction(base_context*, de265_image*, slice_segment_header const*, int, int, int, int, int, int, int, int, int, int, unsigned char*, MotionVector*)
```

### POC

[poc](https://github.com/fdu-sec/poc/raw/main/libde265/poc21)

### Environment

```
Description:	Ubuntu 22.04.2 LTS
gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0
```

### Credit

Yuchuan Meng ([Fudan University](https://secsys.fudan.edu.cn/))
heap-buffer-overflow `libde265/libde265/motion.cc:1719` in `derive_spatial_luma_vector_prediction`
This is a GitHub Issue
repo:libde265
owner:strukturag
Title : heap-buffer-overflow `libde265/libde265/motion.cc:1719` in `derive_spatial_luma_vector_prediction`
Issue date:

--- start body ---
### Description

heap-buffer-overflow `libde265/libde265/motion.cc:1719` in `derive_spatial_luma_vector_prediction(base_context*, de265_image*, slice_segment_header const*, int, int, int, int, int, int, int, int, int, int, unsigned char*, MotionVector*)`

### Version

```
 dec265  v1.0.14
-----------------
usage: dec265 [options] videofile.bin
The video file must be a raw bitstream, or a stream with NAL units (option -n).

options:
  -q, --quiet       do not show decoded image
  -t, --threads N   set number of worker threads (0 - no threading)
  -c, --check-hash  perform hash check
  -n, --nal         input is a stream with 4-byte length prefixed NAL units
  -f, --frames N    set number of frames to process
  -o, --output      write YUV reconstruction
  -d, --dump        dump headers
  -0, --noaccel     do not use any accelerated code (SSE)
  -v, --verbose     increase verbosity level (up to 3 times)
  -L, --no-logging  disable logging
  -B, --write-bytestream FILENAME  write raw bytestream (from NAL input)
  -m, --measure YUV compute PSNRs relative to reference YUV
  -T, --highest-TID select highest temporal sublayer to decode
      --disable-deblocking   disable deblocking filter
      --disable-sao          disable sample-adaptive offset filter
  -h, --help        show help
```

### Replay

```
cd libde265
CC="gcc -fsanitize=address" CXX="g++ -fsanitize=address" ./configure
make -j

# You need to try running poc several times to see the asan result.
./dec265/dec265 ./poc
```

### ASAN

```
==3280661==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61b00000d860 at pc 0x557206ed8a9d bp 0x7ffc7a17d230 sp 0x7ffc7a17d220
READ of size 4 at 0x61b00000d860 thread T0
    #0 0x557206ed8a9c in derive_spatial_luma_vector_prediction(base_context*, de265_image*, slice_segment_header const*, int, int, int, int, int, int, int, int, int, int, unsigned char*, MotionVector*) libde265/libde265/motion.cc:1719
    #1 0x557206ed9950 in fill_luma_motion_vector_predictors(base_context*, slice_segment_header const*, de265_image*, int, int, int, int, int, int, int, int, int, int, MotionVector*) libde265/libde265/motion.cc:1990
    #2 0x557206eee58a in luma_motion_vector_prediction(base_context*, slice_segment_header const*, de265_image*, PBMotionCoding const&, int, int, int, int, int, int, int, int, int, int) libde265/libde265/motion.cc:2063
    #3 0x557206eee58a in motion_vectors_and_ref_indices(base_context*, slice_segment_header const*, de265_image*, PBMotionCoding const&, int, int, int, int, int, int, int, int, PBMotion*) libde265/libde265/motion.cc:2155
    #4 0x557206eee58a in decode_prediction_unit(base_context*, slice_segment_header const*, de265_image*, PBMotionCoding const&, int, int, int, int, int, int, int, int) libde265/libde265/motion.cc:2195
    #5 0x557206db4806 in read_prediction_unit(thread_context*, int, int, int, int, int, int, int, int, int) libde265/libde265/slice.cc:4145
    #6 0x557206dbe5ff in read_coding_unit(thread_context*, int, int, int, int) libde265/libde265/slice.cc:4513
    #7 0x557206dc5696 in decode_substream(thread_context*, bool, bool) libde265/libde265/slice.cc:4750
    #8 0x557206dcbfc9 in read_slice_segment_data(thread_context*) libde265/libde265/slice.cc:5063
    #9 0x557206c8e8b4 in decoder_context::decode_slice_unit_sequential(image_unit*, slice_unit*) libde265/libde265/decctx.cc:854
    #10 0x557206c95e55 in decoder_context::decode_slice_unit_parallel(image_unit*, slice_unit*) libde265/libde265/decctx.cc:956
    #11 0x557206c997eb in decoder_context::decode_some(bool*) libde265/libde265/decctx.cc:741
    #12 0x557206cab57a in decoder_context::read_slice_NAL(bitreader&, NAL_unit*, nal_header&) libde265/libde265/decctx.cc:699
    #13 0x557206cad645 in decoder_context::decode_NAL(NAL_unit*) libde265/libde265/decctx.cc:1241
    #14 0x557206cae508 in decoder_context::decode(int*) libde265/libde265/decctx.cc:1329
    #15 0x557206c6846c in main libde265/dec265/dec265.cc:784
    #16 0x7f14f9029d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #17 0x7f14f9029e3f in __libc_start_main_impl ../csu/libc-start.c:392
    #18 0x557206c6ace4 in _start (eva/asan-bin/NestFuzz/libde265/dec265+0x1ece4)

0x61b00000d860 is located 88 bytes to the right of 1416-byte region [0x61b00000d280,0x61b00000d808)
allocated by thread T0 here:
    #0 0x7f14f98b61e7 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:99
    #1 0x557206ca9f17 in decoder_context::read_slice_NAL(bitreader&, NAL_unit*, nal_header&) libde265/libde265/decctx.cc:635

SUMMARY: AddressSanitizer: heap-buffer-overflow libde265/libde265/motion.cc:1719 in derive_spatial_luma_vector_prediction(base_context*, de265_image*, slice_segment_header const*, int, int, int, int, int, int, int, int, int, int, unsigned char*, MotionVector*)
```

### POC

[poc](https://github.com/fdu-sec/poc/raw/main/libde265/poc21)

### Environment

```
Description:	Ubuntu 22.04.2 LTS
gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0
```

### Credit

Yuchuan Meng ([Fudan University](https://secsys.fudan.edu.cn/))
--- end body ---
