[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170125093901.GA30424@lorien.valinor.li>
Date: Wed, 25 Jan 2017 10:39:01 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: jasper: NULL pointer dereference in
jp2_cdef_destroy (jp2_cod.c)
Hi Agostino
On Wed, Jan 25, 2017 at 10:10:35AM +0100, Agostino Sarubbo wrote:
> Description:
> jasper is an open-source initiative to provide a free software-based reference
> implementation of the codec specified in the JPEG-2000 Part-1 standard.
>
> Another round of fuzzing shows that a crafted image causes a NULL pointer
> access.
>
> The complete ASan output:
>
> # imginfo -f $FILE
> cannot parse box data
> ASAN:DEADLYSIGNAL
> =================================================================
> ==6697==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc
> 0x00000041da35 bp 0xbebebebebebebeae sp 0x7fff60ad6480 T0)
> #0 0x41da34 in atomic_compare_exchange_strong /tmp/portage/sys-
> devel/llvm-3.9.1/work/llvm-3.9.1.src/projects/compiler-
> rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81
> #1 0x41da34 in
> __asan::Allocator::AtomicallySetQuarantineFlagIfAllocated(__asan::AsanChunk*,
> void*, __sanitizer::BufferedStackTrace*) /tmp/portage/sys-
> devel/llvm-3.9.1/work/llvm-3.9.1.src/projects/compiler-
> rt/lib/asan/asan_allocator.cc:468
> #2 0x41da34 in __asan::Allocator::Deallocate(void*, unsigned long,
> __sanitizer::BufferedStackTrace*, __asan::AllocType) /tmp/portage/sys-
> devel/llvm-3.9.1/work/llvm-3.9.1.src/projects/compiler-
> rt/lib/asan/asan_allocator.cc:522
> #3 0x41da34 in __asan::asan_free(void*, __sanitizer::BufferedStackTrace*,
> __asan::AllocType) /tmp/portage/sys-
> devel/llvm-3.9.1/work/llvm-3.9.1.src/projects/compiler-
> rt/lib/asan/asan_allocator.cc:725
> #4 0x4d271c in free /tmp/portage/sys-
> devel/llvm-3.9.1/work/llvm-3.9.1.src/projects/compiler-
> rt/lib/asan/asan_malloc_linux.cc:50
> #5 0x7f86ef11c995 in jp2_cdef_destroy /tmp/portage/media-
> libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jp2/jp2_cod.c:230:3
> #6 0x7f86ef11e18e in jp2_box_destroy /tmp/portage/media-
> libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jp2/jp2_cod.c:212:3
> #7 0x7f86ef11e18e in jp2_box_get /tmp/portage/media-
> libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jp2/jp2_cod.c:319
> #8 0x7f86ef1219f6 in jp2_decode /tmp/portage/media-
> libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jp2/jp2_dec.c:159:16
> #9 0x7f86ef0e4214 in jas_image_decode /tmp/portage/media-
> libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/base/jas_image.c:444:16
> #10 0x50a3be in main /tmp/portage/media-
> libs/jasper-2.0.10/work/jasper-2.0.10/src/appl/imginfo.c:238:16
> #11 0x7f86ee1c478f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-
> r3/work/glibc-2.23/csu/../csu/libc-start.c:289
> #12 0x419cd8 in _start (/usr/bin/imginfo+0x419cd8)
>
> AddressSanitizer can not provide additional info.
> SUMMARY: AddressSanitizer: SEGV /tmp/portage/sys-
> devel/llvm-3.9.1/work/llvm-3.9.1.src/projects/compiler-
> rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81 in
> atomic_compare_exchange_strong
> ==6697==ABORTING
>
> Affected version:
> 2.0.10
>
> Fixed version:
> N/A
>
> Commit fix:
> N/A
>
> Credit:
> This bug was discovered by Agostino Sarubbo of Gentoo.
>
> CVE:
> N/A
>
> Reproducer:
> https://github.com/asarubbo/poc/blob/master/00124-jasper-nullptr-jp2_cdef_destroy
>
> Timeline:
> 2017-01-18: bug discovered and reported upstream
This should be: https://github.com/mdadams/jasper/issues/112
Could you please reference as well the upstream issues, if they are
reported in an upstream issue tracker? That would help much in
tracking the issues.
Regards,
Salvatore
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
