graphicsmagick:coder_HEIF_fuzzer: Heap-buffer-overflow in Op_YCbCr_to_RGB<unsigned char>::convert_colorspace #1796

GraphicsMagick oss-fuzz testing has produced issue 512988067 which appears to be due to libheif code.

This is the reported stack trace:

ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7d722d1ed40f at pc 0x56eb2ec69ef8 bp 0x7ffed540ee70 sp 0x7ffed540ee68
READ of size 1 at 0x7d722d1ed40f thread T0
#0 0x56eb2ec69ef7 in Op_YCbCr_to_RGB::convert_colorspace(std::__1::shared_ptr const&, ColorState const&, ColorState const&, heif_color_conversion_options const&, heif_color_conversion_options_ext const&, heif_security_limits const*) const libheif/libheif/color-conversion/yuv2rgb.cc:269:33
#1 0x56eb2ec44005 in ColorConversionPipeline::convert_image(std::__1::shared_ptr const&, heif_security_limits const*) libheif/libheif/color-conversion/colorconversion.cc:463:38
#2 0x56eb2ec4596a in convert_colorspace(std::__1::shared_ptr const&, heif_colorspace, heif_chroma, nclx_profile const&, int, heif_color_conversion_options const&, heif_color_conversion_options_ext const*, heif_security_limits const*) libheif/libheif/color-conversion/colorconversion.cc:621:21
#3 0x56eb2ee54d8c in HeifContext::convert_to_output_colorspace(std::__1::shared_ptr, heif_colorspace, heif_chroma, heif_decoding_options const&) const libheif/libheif/context.cc:1517:12
#4 0x56eb2ee53b29 in HeifContext::decode_image(unsigned int, heif_colorspace, heif_chroma, heif_decoding_options const&, bool, unsigned int, unsigned int, std::__1::set<unsigned int, std::__1::less, std::__1::allocator>) const libheif/libheif/context.cc:1429:21
#5 0x56eb2eba1d8c in heif_decode_image libheif/libheif/api/libheif/heif_decoding.cc:244:81
#6 0x56eb2e8c1e26 in ReadHEIFImageFrame /src/graphicsmagick/coders/heif.c:1246:17
#7 0x56eb2e8be643 in ReadHEIFImage /src/graphicsmagick/coders/heif.c:2407:10
#8 0x56eb2e6c9f26 in ReadImage /src/graphicsmagick/magick/constitute.c:1682:13
#9 0x56eb2e67b234 in BlobToImage /src/graphicsmagick/magick/blob.c:785:13
#10 0x56eb2e605316 in Magick::Image::read(Magick::Blob const&) /src/graphicsmagick/Magick++/lib/Image.cpp:1601:5
#11 0x56eb2e5f9252 in LLVMFuzzerTestOneInput /src/graphicsmagick/fuzzing/coder_fuzzer.cc:24:11
#12 0x56eb2e4965bd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13
#13 0x56eb2e481332 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6
#14 0x56eb2e487200 in fuzzer::FuzzerDriver(int*, char***, int ()(unsigned char const, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9
#15 0x56eb2e4b2d32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
#16 0x7e822dca9082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/libc-start.c:308:16
#17 0x56eb2e47a41d in _start

These two testcases were provided:

clusterfuzz-testcase-coder_HEIF_fuzzer-5547817258254336.gz

clusterfuzz-testcase-minimized-coder_HEIF_fuzzer-5547817258254336.gz