graphicsmagick:coder_HEIF_fuzzer: Heap-buffer-overflow in JPEG2000MainHeader::parse_SIZ_segment

Due to GraphicsMagick oss-fuzz testing, a heap read overflow in libheif has been discovered while parsing J2K header data. This is oss-fuzz issue [508116649](https://issues.oss-fuzz.com/issues/508116649). The stack trace provided is: > ERROR: AddressSanitizer: heap-buffer-overflow on address 0x772014a0f82f at pc 0x57b34e32ac1c bp 0x7ffcd16a53f0 sp 0x7ffcd16a53e8 > READ of size 1 at 0x772014a0f82f thread T0 > #0 0x57b34e32ac1b in JPEG2000MainHeader::read8() [libheif/libheif/codecs/jpeg2000_boxes.h:496](https://github.com/strukturag/libheif/blob/46521618983c795fdb09a412ebb29e917086896a/libheif/codecs/jpeg2000_boxes.h#L496):23 > #1 0x57b34e32ac1b in JPEG2000MainHeader::parse_SIZ_segment() [libheif/libheif/codecs/jpeg2000_boxes.cc:440](https://github.com/strukturag/libheif/blob/46521618983c795fdb09a412ebb29e917086896a/libheif/codecs/jpeg2000_boxes.cc#L440):20 > #2 0x57b34e328a25 in JPEG2000MainHeader::doParse() [libheif/libheif/codecs/jpeg2000_boxes.cc:365](https://github.com/strukturag/libheif/blob/46521618983c795fdb09a412ebb29e917086896a/libheif/codecs/jpeg2000_boxes.cc#L365):9 > #3 0x57b34e328878 in JPEG2000MainHeader::parseHeader(std::__1::vector<unsigned char, std::__1::allocator<unsigned char>> const&) [libheif/libheif/codecs/jpeg2000_boxes.cc:355](https://github.com/strukturag/libheif/blob/46521618983c795fdb09a412ebb29e917086896a/libheif/codecs/jpeg2000_boxes.cc#L355):10 > #4 0x57b34e31c8e0 in Decoder_JPEG2000::get_luma_bits_per_pixel() const [libheif/libheif/codecs/jpeg2000_dec.cc:43](https://github.com/strukturag/libheif/blob/46521618983c795fdb09a412ebb29e917086896a/libheif/codecs/jpeg2000_dec.cc#L43):22 > #5 0x57b34df9ac4a in ImageItem::get_luma_bits_per_pixel() const [libheif/libheif/image-items/image_item.cc:526](https://github.com/strukturag/libheif/blob/46521618983c795fdb09a412ebb29e917086896a/libheif/image-items/image_item.cc#L526):19 > #6 0x57b34dc91956 in ReadHEIFImageFrame /src/graphicsmagick/coders/heif.c:1002:18 > #7 0x57b34dc90269 in ReadHEIFImage /src/graphicsmagick/coders/heif.c:2376:10 > #8 0x57b34da9d146 in ReadImage /src/graphicsmagick/magick/constitute.c:1682:13 > #9 0x57b34da4e454 in BlobToImage /src/graphicsmagick/magick/blob.c:785:13 > #10 0x57b34d9d8536 in Magick::Image::read(Magick::Blob const&) /src/graphicsmagick/Magick++/lib/Image.cpp:1601:5 > #11 0x57b34d9cc472 in LLVMFuzzerTestOneInput /src/graphicsmagick/fuzzing/coder_fuzzer.cc:24:11 > #12 0x57b34d8697dd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 > #13 0x57b34d854552 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 > #14 0x57b34d85a420 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 > #15 0x57b34d885f52 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 > #16 0x786015456082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/libc-start.c:308:16 > #17 0x57b34d84d63d in _start > > 0x772014a0f82f is located 0 bytes after 30255-byte region [0x772014a08200,0x772014a0f82f) > allocated by thread T0 here: > #0 0x57b34d9cab0d in operator new(unsigned long) /src/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:109:35 > #1 0x57b34e00666e in unsigned char* std::__1::__libcpp_allocate[abi:ne220000]<unsigned char>(std::__1::__element_count, unsigned long) /usr/local/include/c++/v1/__new/allocate.h:43:28 > #2 0x57b34e00666e in std::__1::allocator<unsigned char>::allocate[abi:ne220000](unsigned long) /usr/local/include/c++/v1/__memory/allocator.h:105:14 > #3 0x57b34e00666e in std::__1::__allocation_result<std::__1::allocator_traits<std::__1::allocator<unsigned char>>::pointer> std::__1::__allocate_at_least[abi:ne220000]<std::__1::allocator<unsigned char>>(std::__1::allocator<unsigned char>&, unsigned long) /usr/local/include/c++/v1/__memory/allocate_at_least.h:41:19 > #4 0x57b34e00666e in std::__1::vector<unsigned char, std::__1::allocator<unsigned char>>::__vallocate[abi:ne220000](unsigned long) /usr/local/include/c++/v1/__vector/vector.h:583:25 > #5 0x57b34e00666e in void std::__1::vector<unsigned char, std::__1::allocator<unsigned char>>::__assign_with_size[abi:ne220000]<unsigned char*, unsigned char*>(unsigned char*, unsigned char*, long) /usr/local/include/c++/v1/__vector/vector.h:1083:5 > #6 0x57b34e328865 in void std::__1::vector<unsigned char, std::__1::allocator<unsigned char>>::assign[abi:ne220000]<unsigned char*, 0>(unsigned char*, unsigned char*) /usr/local/include/c++/v1/__vector/vector.h:320:5 > #7 0x57b34e328865 in std::__1::vector<unsigned char, std::__1::allocator<unsigned char>>::operator=[abi:ne220000](std::__1::vector<unsigned char, std::__1::allocator<unsigned char>> const&) /usr/local/include/c++/v1/__vector/vector.h:1042:5 > #8 0x57b34e328865 in JPEG2000MainHeader::parseHeader(std::__1::vector<unsigned char, std::__1::allocator<unsigned char>> const&) [libheif/libheif/codecs/jpeg2000_boxes.cc:354](https://github.com/strukturag/libheif/blob/46521618983c795fdb09a412ebb29e917086896a/libheif/codecs/jpeg2000_boxes.cc#L354):14 > #9 0x57b34e31c8e0 in Decoder_JPEG2000::get_luma_bits_per_pixel() const [libheif/libheif/codecs/jpeg2000_dec.cc:43](https://github.com/strukturag/libheif/blob/46521618983c795fdb09a412ebb29e917086896a/libheif/codecs/jpeg2000_dec.cc#L43):22 > #10 0x57b34df9ac4a in ImageItem::get_luma_bits_per_pixel() const [libheif/libheif/image-items/image_item.cc:526](https://github.com/strukturag/libheif/blob/46521618983c795fdb09a412ebb29e917086896a/libheif/image-items/image_item.cc#L526):19 > #11 0x57b34dc91956 in ReadHEIFImageFrame /src/graphicsmagick/coders/heif.c:1002:18 > #12 0x57b34dc90269 in ReadHEIFImage /src/graphicsmagick/coders/heif.c:2376:10 > #13 0x57b34da9d146 in ReadImage /src/graphicsmagick/magick/constitute.c:1682:13 > #14 0x57b34da4e454 in BlobToImage /src/graphicsmagick/magick/blob.c:785:13 > #15 0x57b34d9d8536 in Magick::Image::read(Magick::Blob const&) /src/graphicsmagick/Magick++/lib/Image.cpp:1601:5 > #16 0x57b34d9cc472 in LLVMFuzzerTestOneInput /src/graphicsmagick/fuzzing/coder_fuzzer.cc:24:11 > #17 0x57b34d8697dd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 > #18 0x57b34d854552 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 > #19 0x57b34d85a420 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 > #20 0x57b34d885f52 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 > #21 0x786015456082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/libc-start.c:308:16 These two input files were provided: [clusterfuzz-testcase-coder_HEIF_fuzzer-6361612268404736.gz](https://github.com/user-attachments/files/27243863/clusterfuzz-testcase-coder_HEIF_fuzzer-6361612268404736.gz) [clusterfuzz-testcase-minimized-coder_HEIF_fuzzer-6361612268404736.gz](https://github.com/user-attachments/files/27243875/clusterfuzz-testcase-minimized-coder_HEIF_fuzzer-6361612268404736.gz)