Heap buffer over-read in avi_parse_input_file() when parsing truncated hdrl strh chunk

[BreakingBad6]

Minimal harness

#include <stdio.h>
#include "../example/theora/win32/experimental/transcoder/avi2vp3/avilib.h"

int main(int argc, char **argv) {
    const char *path = "poc/avilib_hdrl_oob/avilib_hdrl_short_strh.avi";
    avi_t *avi;

    if (argc > 1) {
        path = argv[1];
    }

    printf("opening: %s\n", path);
    avi = AVI_open_input_file((char *)path, 1);
    if (!avi) {
        AVI_print_error("AVI_open_input_file failed");
        return 1;
    }

    printf("opened successfully\n");
    AVI_close(avi);
    return 0;
}

Build
clang -g -O0 -fsanitize=address -fno-omit-frame-pointer -Iexample/theora/win32/experimental/transcoder/avi2vp3 poc/avilib_hdrl_asan_harness.c example/theora/win32/experimental/transcoder/avi2vp3/avilib.c -o avilib_hdrl_asan_harness

Run
ASAN_OPTIONS=detect_leaks=0:abort_on_error=1:symbolize=1 ./avilib_hdrl_asan_harness poc/avilib_hdrl_oob/avilib_hdrl_short_strh.avi

ASan result
The crash is an AddressSanitizer heap-buffer-overflow read in:

memcpy(AVI->compressor,hdrl_data+i+4,4)
The allocated heap region is created at:

hdrl_data = (unsigned char *) malloc(n);
I will attach the ASan output screenshot separately.

Impact
This issue allows a malformed AVI file to trigger a heap out-of-bounds read and crash the parser. Based on current analysis, this appears to be a denial-of-service / parser robustness issue caused by missing bounds checks in hdrl sub-chunk parsing.

Suggested fix
Before reading any nested hdrl chunk fields:

Verify that at least 8 bytes remain for the chunk header.
Verify that the declared chunk length fits within the remaining hdrl_data buffer.
For strh / strf, verify that the remaining bytes are sufficient for all fixed-offset accesses before reading fields such as +4, +14, +16, +20, +24, or +32.
Abort parsing on malformed or truncated sub-chunks.

[BreakingBad6]

the poc:

新建文件夹 (10).zip

[carnil]

This appears to have CVE-2026-5673 assigned.

[BreakingBad6]

yes！

Now it can be closed