With a specially crafted WebP lossless file, libwebp may write data out of bounds to the heap. The ReadHuffmanCodes() function allocates the HuffmanCode buffer with a size that comes from an array of precomputed sizes: kTableSize. The color_cache_bits value defines which size to use. The kTableSize array only takes into account sizes for 8-bit first-level table lookups but not second-level table lookups. libwebp allows codes that are up to 15-bit (MAX_ALLOWED_CODE_LENGTH). When BuildHuffmanTable() attempts to fill the second-level tables it may write data out-of-bounds. The OOB write to the undersized array happens in ReplicateValue. https://chromium.googlesource.com/webm/libwebp/+/902bc9190331343b2017211debcec8d2ab87e17a https://chromium.googlesource.com/webm/libwebp/+/2af26267cdfcb63a88e5c74a85927a12d6ca1d76
Created chromium tracking bugs for this issue: Affects: epel-all [bug 2241119] Affects: fedora-all [bug 2241120] Created firefox tracking bugs for this issue: Affects: fedora-all [bug 2241122] Created libwebp tracking bugs for this issue: Affects: fedora-all [bug 2241121]
RHEL-7 Erratas: https://access.redhat.com/errata/RHSA-2023:5197 https://access.redhat.com/errata/RHSA-2023:5191 RHEL-8 Erratas: https://access.redhat.com/errata/RHSA-2023:5184 https://access.redhat.com/errata/RHSA-2023:5183 https://access.redhat.com/errata/RHSA-2023:5192 https://access.redhat.com/errata/RHSA-2023:5198 https://access.redhat.com/errata/RHSA-2023:5187 https://access.redhat.com/errata/RHSA-2023:5236 https://access.redhat.com/errata/RHSA-2023:5222 https://access.redhat.com/errata/RHSA-2023:5189 https://access.redhat.com/errata/RHSA-2023:5190 https://access.redhat.com/errata/RHSA-2023:5309 https://access.redhat.com/errata/RHSA-2023:5202 https://access.redhat.com/errata/RHSA-2023:5201 https://access.redhat.com/errata/RHSA-2023:5188 https://access.redhat.com/errata/RHSA-2023:5186 https://access.redhat.com/errata/RHSA-2023:5185 RHEL-9 Erratas: https://access.redhat.com/errata/RHSA-2023:5200 https://access.redhat.com/errata/RHSA-2023:5205 https://access.redhat.com/errata/RHSA-2023:5204 https://access.redhat.com/errata/RHSA-2023:5214 https://access.redhat.com/errata/RHSA-2023:5224 https://access.redhat.com/errata/RHSA-2023:5223
*** This bug has been marked as a duplicate of bug 2238431 ***