CVE-2022-32201: NULL Pointer Dereference (CWE-476)
value: In libjpeg 1.63, there is a NULL pointer dereference in Component::SubXOf in component.hpp.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-06-02T14:16Z
Repository: https://github.com/thorfdbg/libjpeg
Language: C++
Files changed: codestream/entropyparser.cpp, marker/scan.cpp
Commit date: 2022-05-30 16:07:05 +0200
Commit message: Added a check whether all components in a scan are actually present.

Diff: diff --git a/codestream/entropyparser.cpp b/codestream/entropyparser.cpp
index 196cc00..5b3858c 100644
--- a/codestream/entropyparser.cpp
+++ b/codestream/entropyparser.cpp
@@ -41,11 +41,11 @@
 /*
 **
 ** This class represents the interface for parsing the
 ** entropy coded data in JPEG as part of a single scan.
 **
-** $Id: entropyparser.cpp,v 1.24 2021/09/08 10:30:06 thor Exp $
+** $Id: entropyparser.cpp,v 1.25 2022/05/30 14:05:58 thor Exp $
 **
 */
 
 /// Includes
 #include "tools/environment.hpp"
@@ -60,11 +60,11 @@
 EntropyParser::EntropyParser(class Frame *frame,class Scan *scan)
   : JKeeper(scan->EnvironOf()), m_pScan(scan), m_pFrame(frame)
 {
   m_ucCount = scan->ComponentsInScan();
 
-  // The residual scan uses all components here, not just for, but
+  // The residual scan uses all components here, not just four, but
   // it does not require the component count either.
   for(volatile UBYTE i = 0;i < m_ucCount && i < 4;i++) {
     JPG_TRY {
       m_pComponent[i] = scan->ComponentOf(i);
     } JPG_CATCH {
diff --git a/marker/scan.cpp b/marker/scan.cpp
index b8e52e8..f85aac7 100644
--- a/marker/scan.cpp
+++ b/marker/scan.cpp
@@ -40,11 +40,11 @@
 *************************************************************************/
 /*
 **
 ** Represents all data in a single scan, and hence is the SOS marker.
 **
-** $Id: scan.cpp,v 1.117 2021/11/15 07:39:43 thor Exp $
+** $Id: scan.cpp,v 1.118 2022/05/30 14:06:11 thor Exp $
 **
 */
 
 /// Includes
 #include "marker/scan.hpp"
@@ -336,10 +336,18 @@ void Scan::CreateParser(void)
 {
   ScanType type = m_pFrame->ScanTypeOf();
   //
   assert(m_pParser == NULL);
   //
+  // Check whether all components are there.
+  for(UBYTE i = 0;i < m_ucCount && i < 4;i++) {
+    if (ComponentOf(i) == NULL) {
+      JPG_THROW(MALFORMED_STREAM,"Scan::CreateParser",
+                "found a component ID in a scan that does not exist");
+    }
+  }
+  //
   switch(type) {
   case Baseline:
     m_pParser = new(m_pEnviron) class SequentialScan(m_pFrame,this,
                                                      m_ucScanStart,m_ucScanStop,
                                                      m_ucLowBit + m_ucHiddenBits,

Vulnerable code: ** $Id: entropyparser.cpp,v 1.24 2021/09/08 10:30:06 thor Exp $
  // The residual scan uses all components here, not just for, but
** $Id: scan.cpp,v 1.117 2021/11/15 07:39:43 thor Exp $
Fixed code: ** $Id: entropyparser.cpp,v 1.25 2022/05/30 14:05:58 thor Exp $
  // The residual scan uses all components here, not just four, but
** $Id: scan.cpp,v 1.118 2022/05/30 14:06:11 thor Exp $
  // Check whether all components are there.
  for(UBYTE i = 0;i < m_ucCount && i < 4;i++) {
    if (ComponentOf(i) == NULL) {
      JPG_THROW(MALFORMED_STREAM,"Scan::CreateParser",
                "found a component ID in a scan that does not exist");
    }
  }
  //