Review of the libwebp vulnerability (POST not finished yet)

Resources:

Video: https://www.youtube.com/watch?v=PJLWlmp8CDM

https://dayzerosec.com/vulns/2024/01/08/exploiting-the-libwebp-vulnerability-part-1-playing-with-huffman-code.html

Background: What Is libwebp and Why It Matters

• WebP is a modern image format developed by Google that compresses images efficiently. Wikipedia
• libwebp is an open-source library used by many apps (browsers, messaging apps, desktop software) to decode WebP images. Snyk
• Because it’s widely used inside many programs, a flaw inside the decoder affects a lot of software at once. SOCRadar® Cyber Intelligence Inc.

The vulnerability in question (tracked as CVE-2023-4863 / CVE-2023-5129) is a heap buffer overflow that happens when libwebp decodes a malicious WebP image. Huntress

Core Concepts You Need to Understand First

1. What is Huffman Coding?

Huffman coding is a common algorithm used inside compression formats. It represents common symbols with short codes and rare ones with longer codes.

When decoding, the library builds a Huffman table in memory to map compressed bits back to pixel data. darknavy.org

2. What Is a Heap Buffer Overflow?

A heap buffer overflow happens when more data is written into a memory buffer than was allocated for it. If unchecked, this can corrupt nearby memory — potentially allowing an attacker to control program behavior. Huntress

Where the Vulnerability Happens (Simplified)

1. libwebp reads a WebP image and starts decompressing it.
2. To decompress, it builds Huffman tables based on data inside the image. darknavy.org
3. The code assumes input data is “reasonable” and allocates a fixed amount of memory for the Huffman table. darknavy.org
4. A carefully crafted image breaks these assumptions, causing the code to allocate too few bytes but then try to fill the table anyway. darknavy.org
5. While filling the table, writes go past the allocated space → this is the heap overflow. darknavy.org

This invalid write happens specifically inside the function that builds the Huffman table, during repetitive operations that place symbols into memory slots. darknavy.org

Why Huffman Table Construction Fails

In normal Huffman coding, a valid compressed image ensures:

• The number of codes follows specific mathematical rules
• The table has a predictable size and structure

But a malicious image can give Huffman parameters that trick the decoder into allocating too little memory while telling it to store more codes than expected. darknavy.org

So the logic error is:
Allocator reserves memory based on one assumption
Decoder tries to write a larger table than that memory can hold

That leads to memory being written outside its intended buffer — heap buffer overflow. darknavy.org

Can This Crash the Program?

Yes. Out-of-bounds writes usually lead to:

• Crashes (segfaults)
• Memory corruption
• Possibly arbitrary code execution

With enough carefully chosen data and precise control over where and what gets overwritten, attackers can sometimes gain full control of the program (remote code execution). Huntress

Exploitation Primitives — What the Article Is Really Doing

The article doesn’t stop at just describing the bug — it gets into exploitation primitives, that is:

What attacker wants

1. Trigger an overflow
2. Control what gets written
3. Control where it’s written
4. Use that to hijack execution

How They Control What’s Written

Each Huffman table entry consists of:

struct HuffmanCode {
    uint8_t bits;
    uint16_t value;
};

So an attacker can influence the value field in the overflowed data, giving some control over what gets written. darknavy.org

How They Control Where It’s Written

The overflow doesn’t write sequentially; it uses a function called GetNextKey that gives the index where the next symbol goes. darknavy.org

By crafting the Huffman encoded data carefully, the attacker can guide the writes into:

• specific offsets in memory,
• overwrite adjacent heap chunks,
• and eventually put malicious values where the program might read them later. darknavy.org

This is how they get partial control of memory in a predictable way.

In Simpler Words

Here’s an analogy:

The decoder prepares a bookshelf with 10 slots.
But the malicious image tells the decoder “the bookshelf has 30 books!”
The decoder still tries to put 30 books into the 10 slots.
Result: 20 books spill over and crash into nearby objects.

In exploitation, you don’t just want spilled books — you want them to land where YOU choose. The blog goes into how to craft the image so that the extra Huffman entries get placed in useful memory areas, not random garbage.

Final Summary of the Vulnerability

Key Takeaways

You don’t need a WebP file to be executable — the flaw is in the decoder logic.
Carefully crafted compressed data can overflow memory. darknavy.org
Exploiting it requires controlling both the structure and contents of the overflow. darknavy.org
This is why a benign image can crash, but a crafted one can be much worse. Huntress