Excessive KTX2 layer count causes allocation-failure abort in basis_universal
fixed
Details
basis_universal Binomial LLC through commit 1b33fd5098c6; fixed in 3454230 CWE-789 medium fixed Timeline
18 Jul 2026 18 Jul 2026 18 Jul 2026 References
Notes
For KTX2 supercompression formats using per-image slice descriptors, a
file-controlled layerCount flowed into an unchecked 32-bit image-count product
and the terminating vector resize() path. A small crafted file could request
approximately 16 GiB and terminate the process on allocation failure.
Upstream commit 3454230543d5 bounds the layer count, computes the product in
64-bit, validates descriptor bytes against the file before allocation, and uses
try_resize(). Independent verification confirmed the PoC is rejected without
allocation or abort and all 33 valid KTX2 seeds pass under ASan/UBSan. The fix is
on master, newer than v2_10_final_snapshot. Reported and fixed the same day;
the maintainer acknowledged and pushed the fix publicly.