CVE-2013-7017: Other (NVD-CWE-Other)
value: libavcodec/jpeg2000.c in FFmpeg before 2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) or possibly have unspecified other impact via crafted JPEG2000 data.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2013-12-09T16:36Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/jpeg2000.c
Commit date: 2013-08-23 17:36:53 +0200
Commit message: jpeg2000: fix dereferencing invalid pointers

Found-by: Laurent Butti <laurentb@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Diff: diff --git a/libavcodec/jpeg2000.c b/libavcodec/jpeg2000.c
index cb1a64d1432..dc3311052ee 100644
--- a/libavcodec/jpeg2000.c
+++ b/libavcodec/jpeg2000.c
@@ -270,11 +270,11 @@ int ff_jpeg2000_init_component(Jpeg2000Component *comp,
             reslevel->num_precincts_y =
                 ff_jpeg2000_ceildivpow2(reslevel->coord[1][1],
                                         reslevel->log2_prec_height) -
                 (reslevel->coord[1][0] >> reslevel->log2_prec_height);
 
-        reslevel->band = av_malloc_array(reslevel->nbands, sizeof(*reslevel->band));
+        reslevel->band = av_calloc(reslevel->nbands, sizeof(*reslevel->band));
         if (!reslevel->band)
             return AVERROR(ENOMEM);
 
         for (bandno = 0; bandno < reslevel->nbands; bandno++, gbandno++) {
             Jpeg2000Band *band = reslevel->band + bandno;
@@ -366,11 +366,11 @@ int ff_jpeg2000_init_component(Jpeg2000Component *comp,
             for (j = 0; j < 2; j++)
                 band->coord[0][j] = ff_jpeg2000_ceildiv(band->coord[0][j], dx);
             for (j = 0; j < 2; j++)
                 band->coord[1][j] = ff_jpeg2000_ceildiv(band->coord[1][j], dy);
 
-            band->prec = av_malloc_array(reslevel->num_precincts_x *
+            band->prec = av_calloc(reslevel->num_precincts_x *
                                          (uint64_t)reslevel->num_precincts_y,
                                          sizeof(*band->prec));
             if (!band->prec)
                 return AVERROR(ENOMEM);
 
@@ -507,14 +507,16 @@ void ff_jpeg2000_cleanup(Jpeg2000Component *comp, Jpeg2000CodingStyle *codsty)
         Jpeg2000ResLevel *reslevel = comp->reslevel + reslevelno;
 
         for (bandno = 0; bandno < reslevel->nbands; bandno++) {
             Jpeg2000Band *band = reslevel->band + bandno;
             for (precno = 0; precno < reslevel->num_precincts_x * reslevel->num_precincts_y; precno++) {
-                Jpeg2000Prec *prec = band->prec + precno;
-                av_freep(&prec->zerobits);
-                av_freep(&prec->cblkincl);
-                av_freep(&prec->cblk);
+                if (band->prec) {
+                    Jpeg2000Prec *prec = band->prec + precno;
+                    av_freep(&prec->zerobits);
+                    av_freep(&prec->cblkincl);
+                    av_freep(&prec->cblk);
+                }
             }
 
             av_freep(&band->prec);
         }
         av_freep(&reslevel->band);

Vulnerable code:         reslevel->band = av_malloc_array(reslevel->nbands, sizeof(*reslevel->band));
            band->prec = av_malloc_array(reslevel->num_precincts_x *
                Jpeg2000Prec *prec = band->prec + precno;
                av_freep(&prec->zerobits);
                av_freep(&prec->cblkincl);
                av_freep(&prec->cblk);
Fixed code:         reslevel->band = av_calloc(reslevel->nbands, sizeof(*reslevel->band));
            band->prec = av_calloc(reslevel->num_precincts_x *
                if (band->prec) {
                    Jpeg2000Prec *prec = band->prec + precno;
                    av_freep(&prec->zerobits);
                    av_freep(&prec->cblkincl);
                    av_freep(&prec->cblk);
                }