一、漏洞信息
漏洞编号: vul-967294758072356864
漏洞归属组件:
漏洞归属版本:
CVSS V3.0分值:
BaseScore: 5.3 中危
Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
漏洞简述: Step: Store &(argValue[0]) to nVal->!20 in openharmony/src/foundation/multimedia/video_processing_engine/framework/capi/image_processing/detail_enhance_napi_formal.cpp:730 if (!PrepareNapiEnv(env, info, &nVal)) {
code context as follows:
contrastContext_->curRatio, contrastContext_->maxRatio);
return true;
}

bool VpeNapi::ParseLCDParameter(napi_env env, napi_callback_info info, NapiValues& nVal)
{
VPETrace vpeTrace("VpeNapi::DetailEnhance");
std::lock_guardstd::mutex lock(g_contrastLock);
nVal.argc = NUM_3;
napi_value argValue[NUM_3] = {0};
nVal.argv = argValue;
if (!PrepareNapiEnv(env, info, &nVal)) {
return false;
}
if (nVal.argc != NUM_3) {
VPE_LOGE("Invalid args count %{public}zu", nVal.argc);
return false;
} else {
CHECK_AND_RETURN_RET_LOG(ParserImageType(env, argValue[NUM_0]) == ImageType::TYPE_PIXEL_MAP,
false, "Arg 0 type is not pixelmap");
contrastContext_->lcdPixelMap = PixelMapNapi::GetPixelMap(env, argValue[NUM_0]);

Step: Return with value nVal->!20 modified (Invalid Use of Stack Address, CWE-562) in openharmony/src/foundation/multimedia/video_processing_engine/framework/capi/image_processing/detail_enhance_napi_formal.cpp:754
code context as follows:
CHECK_AND_RETURN_RET_LOG(napi_get_value_double(env, nVal.argv[NUM_2],
&(contrastContext_->defaultRatio)) == napi_ok, false, "Failed to parse lcd param. Arg 2 type mismatch");
CHECK_AND_RETURN_RET_LOG(contrastContext_->lcdPixelMap->GetWidth() > 0 &&
contrastContext_->lcdPixelMap->GetHeight() > 0, false, "invalid resolution");
contrastContext_->lcdWidth = static_cast(contrastContext_->lcdPixelMap->GetWidth());
contrastContext_->lcdHeight = static_cast(contrastContext_->lcdPixelMap->GetHeight());
}
VPE_LOGI("update content info: lcdWidth:%{public}d, lcdHeight:%{public}d",
contrastContext_->lcdWidth, contrastContext_->lcdHeight);
return true;
}

napi_value VpeNapi::SetLcdImage(napi_env env, napi_callback_info info)
{
VPE_LOGI("set lcd image");
VPETrace vpeTrace("VpeNapi::DetailEnhanceProcess");
napi_value result = nullptr;
if (contrastContext_ == nullptr) {
contrastContext_ = std::make_shared();
VPE_LOGI("create new contrast context");
}
漏洞公开时间:
漏洞详情参考链接:

漏洞分析指导链接:
漏洞数据来源:
其他:
漏洞补丁信息:

二、漏洞分析结构反馈
影响性分析说明:
Vulnerability Summary for vul-967294758072356864
openHarmony评分:
受影响版本:
OpenHarmony-v6.1-Release
三、漏洞修复
安全公告链接: