CVE-2021-26927: NULL Pointer Dereference (CWE-476)
value: A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of service.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2021-02-23T20:15Z
Repository: https://github.com/jasper-software/jasper
Language: C
Files changed: src/libjasper/jp2/jp2_dec.c
Commit date: 2021-02-07 12:31:55 -0800
Commit message: Fixes #264.

The JP2 decoder was allowing the decoding of a code stream to be
attempted when the stream has inconsistent values for the number of
components and/or the component types.  For such invalid streams,
only a warning would be issued and decoding would proceed.  This is
dangerous, however, as it can lead to many unexpected paths through
the code, which in some cases have been demonstrated to result in
security vulnerabilities.  This code change makes decoding of these
types invalid code streams a hard error.

Diff: diff --git a/data/test/bad/poc_264.jp2 b/data/test/bad/poc_264.jp2
new file mode 100644
index 0000000..ebdf563
Binary files /dev/null and b/data/test/bad/poc_264.jp2 differ
diff --git a/src/libjasper/jp2/jp2_dec.c b/src/libjasper/jp2/jp2_dec.c
index 60dee42..78d6cef 100644
--- a/src/libjasper/jp2/jp2_dec.c
+++ b/src/libjasper/jp2/jp2_dec.c
@@ -230,11 +230,12 @@ jas_image_t *jp2_decode(jas_stream_t *in, const char *optstr)
 
 	/* Does the number of components indicated in the IHDR box match
 	  the value specified in the code stream? */
 	if (dec->ihdr->data.ihdr.numcmpts != JAS_CAST(jas_uint,
 	  jas_image_numcmpts(dec->image))) {
-		jas_eprintf("warning: number of components mismatch\n");
+		jas_eprintf("error: number of components mismatch (IHDR)\n");
+		goto error;
 	}
 
 	/* At least one component must be present. */
 	if (!jas_image_numcmpts(dec->image)) {
 		jas_eprintf("error: no components\n");
@@ -253,11 +254,12 @@ jas_image_t *jp2_decode(jas_stream_t *in, const char *optstr)
 
 	/* Is the component data type indicated in the IHDR box consistent
 	  with the data in the code stream? */
 	if ((samedtype && dec->ihdr->data.ihdr.bpc != JP2_DTYPETOBPC(dtype)) ||
 	  (!samedtype && dec->ihdr->data.ihdr.bpc != JP2_IHDR_BPCNULL)) {
-		jas_eprintf("warning: component data type mismatch (IHDR)\n");
+		jas_eprintf("error: component data type mismatch (IHDR)\n");
+		goto error;
 	}
 
 	/* Is the compression type supported? */
 	if (dec->ihdr->data.ihdr.comptype != JP2_IHDR_COMPTYPE) {
 		jas_eprintf("error: unsupported compression type\n");
@@ -265,22 +267,24 @@ jas_image_t *jp2_decode(jas_stream_t *in, const char *optstr)
 	}
 
 	if (dec->bpcc) {
 		/* Is the number of components indicated in the BPCC box
 		  consistent with the code stream data? */
-		if (dec->bpcc->data.bpcc.numcmpts != JAS_CAST(jas_uint, jas_image_numcmpts(
-		  dec->image))) {
-			jas_eprintf("warning: number of components mismatch\n");
+		if (dec->bpcc->data.bpcc.numcmpts !=
+		  JAS_CAST(jas_uint, jas_image_numcmpts(dec->image))) {
+			jas_eprintf("error: number of components mismatch (BPCC)\n");
+			goto error;
 		}
 		/* Is the component data type information indicated in the BPCC
 		  box consistent with the code stream data? */
 		if (!samedtype) {
 			for (i = 0; i < JAS_CAST(jas_uint, jas_image_numcmpts(dec->image));
 			  ++i) {
 				if (jas_image_cmptdtype(dec->image, i) !=
 				  JP2_BPCTODTYPE(dec->bpcc->data.bpcc.bpcs[i])) {
-					jas_eprintf("warning: component data type mismatch (BPCC)\n");
+					jas_eprintf("error: component data type mismatch (BPCC)\n");
+						goto error;
 				}
 			}
 		} else {
 			jas_eprintf("warning: superfluous BPCC box\n");
 		}

Vulnerable code: 		jas_eprintf("warning: number of components mismatch\n");
		jas_eprintf("warning: component data type mismatch (IHDR)\n");
		if (dec->bpcc->data.bpcc.numcmpts != JAS_CAST(jas_uint, jas_image_numcmpts(
		  dec->image))) {
			jas_eprintf("warning: number of components mismatch\n");
					jas_eprintf("warning: component data type mismatch (BPCC)\n");
Fixed code: 		jas_eprintf("error: number of components mismatch (IHDR)\n");
		goto error;
		jas_eprintf("error: component data type mismatch (IHDR)\n");
		goto error;
		if (dec->bpcc->data.bpcc.numcmpts !=
		  JAS_CAST(jas_uint, jas_image_numcmpts(dec->image))) {
			jas_eprintf("error: number of components mismatch (BPCC)\n");
			goto error;
					jas_eprintf("error: component data type mismatch (BPCC)\n");
						goto error;