Bug 51370

Created attachment 16779 [details]
Архив с изображением формата HEIF, для тестирования конвертора

Наложил патч
https://github.com/strukturag/libheif/pull/1074/commits/877de6b398198bca387df791b9232922c5721c80
Патч устраняет баг CVE-2024-25269, приводящий к утечкам памяти. Утечки памяти могут приводить к отказу в обслуживании.
Оформил в виде релиза 1.17.6-alt2: http://git.altlinux.ru/people/dfpl/packages/?p=libheif.git;a=log
Как воспроизвести баг, рассказано здесь:
https://github.com/strukturag/libheif/issues/1073

Пропатченный вариант работает без ошибок:
$ mkdir build
$ cd build
$ export CC=gcc CXX=g++ CFLAGS="-O0 -fsanitize=address,undefined -fno-omit-frame-pointer" CXXFLAGS="-O0 -fsanitize=address,undefined -fno-omit-frame-pointer" LDFLAGS="-fsanitize=address,undefined"
$ cmake -DCMAKE_BUILD_TYPE=Debug -DWITH_UNCOMPRESSED_CODEC=ON ..
$ make
$ ./examples/heif-convert ./poc21 1.jpg
File contains 1 image
Invalid EXIF data (offset too large)
could not write image

Непропатченный выдавал утечки памяти:
...
$ ./examples/heif-convert ./poc21 1.jpg
File contains 1 image
Invalid EXIF data (offset too large)
could not write image

=================================================================
==139437==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 168 byte(s) in 1 object(s) allocated from:
    #0 0x7f2e028de54f in __interceptor_malloc (/lib64/libasan.so.8+0xde54f) (BuildId: 7fddca0260282f7c2913774e2c4cfec0246c7099)
    #1 0x7f2e02effe7d  (/lib64/libjpeg.so.62+0x41e7d) (BuildId: 3546ab7cd5e2f2fcc89500425d25d601bb02a205)

Direct leak of 100 byte(s) in 1 object(s) allocated from:
    #0 0x7f2e028de54f in __interceptor_malloc (/lib64/libasan.so.8+0xde54f) (BuildId: 7fddca0260282f7c2913774e2c4cfec0246c7099)
    #1 0x55e8ee55be93 in Encoder::GetExifMetaData(heif_image_handle const*, unsigned long*) /usr/src/man/libheif/examples/encoder.cc:54
    #2 0x55e8ee573e3f in JpegEncoder::Encode(heif_image_handle const*, heif_image const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /usr/src/man/libheif/examples/encoder_jpeg.cc:174
    #3 0x55e8ee56618a in main /usr/src/man/libheif/examples/heif_convert.cc:509
    #4 0x7f2dffc3fc8b  (/lib64/libc.so.6+0x27c8b) (BuildId: 97aecaf3aeb712a8e66d84b5319d6cca2cf5528e)

Indirect leak of 23242 byte(s) in 6 object(s) allocated from:
    #0 0x7f2e028de54f in __interceptor_malloc (/lib64/libasan.so.8+0xde54f) (BuildId: 7fddca0260282f7c2913774e2c4cfec0246c7099)
    #1 0x7f2e02ee7873  (/lib64/libjpeg.so.62+0x29873) (BuildId: 3546ab7cd5e2f2fcc89500425d25d601bb02a205)

Indirect leak of 20865 byte(s) in 7 object(s) allocated from:
    #0 0x7f2e028de54f in __interceptor_malloc (/lib64/libasan.so.8+0xde54f) (BuildId: 7fddca0260282f7c2913774e2c4cfec0246c7099)
    #1 0x7f2e02f01f9f  (/lib64/libjpeg.so.62+0x43f9f) (BuildId: 3546ab7cd5e2f2fcc89500425d25d601bb02a205)

SUMMARY: AddressSanitizer: 44375 byte(s) leaked in 15 allocation(s).