NULL Pointer Dereference in libde265 NAL Parsing

Executive Summary

This vulnerability is a NULL pointer dereference in the libde265 library. When a zero-length NAL unit is passed to de265_push_NAL(), it creates a NAL_unit with a NULL backing buffer. This NULL pointer is then used as the destination in a memcpy() call, violating the function's nonnull requirement and causing undefined behavior. In builds with sanitizers like UBSan, this triggers a process termination and denial of service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes or SIGILL signals (exit code 132) in applications using libde265 when processing zero-length NAL units. Check logs for undefined behavior errors in UBSan-instrumented builds. Validate input lengths in NAL units before processing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause applications using libde265 to crash or terminate unexpectedly when processing malformed video data. In production environments, this leads to service disruptions and potential denial of service. Systems relying on libde265 for video decoding may become unstable or unresponsive.

Useful 0 Not Useful 0

Mitigation Strategies

Update libde265 to a patched version that includes input validation for NAL units. Ensure zero-length NAL units are rejected early in de265_push_NAL and NAL_Parser::push_NAL functions. Add null checks in NAL_unit::set_data and NAL_unit::append_data methods.

Useful 0 Not Useful 0