Project: libjpeg-turbo (libjpeg-turbo/libjpeg-turbo), language: c++
Vulnerability instance: libjpeg-turbo.cve-2020-17541
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/libjpeg-turbo/libjpeg-turbo/issues/392
## Description:
Issue: libjpeg-turbo/libjpeg-turbo#392
Title: report a stack buffer overflow security issue
State: closed
Created by: lxkeklx
Created at: 2019-12-05 13:46:42+00:00
Labels: bug, fixed

Issue Body:
There' s a stack buffer overflow in encode_one_block function, the backtrace of the crash point is below. The version is the latest from the git main branch:

```
./jpegtran-static -transverse ~/Desktop/poc.jpg
```

```
=================================================================
==11652==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd03285910 at pc 0x00000051103c bp 0x7ffd03285700 sp 0x7ffd032856f0
WRITE of size 1 at 0x7ffd03285910 thread T0
    #0 0x51103b in encode_one_block /home/zwjj/research/libjpeg-turbo/jchuff.c:600
    #1 0x51103b in encode_mcu_huff /home/zwjj/research/libjpeg-turbo/jchuff.c:684
    #2 0x475668 in compress_output /home/zwjj/research/libjpeg-turbo/jctrans.c:349
    #3 0x4443da in jpeg_finish_compress /home/zwjj/research/libjpeg-turbo/jcapimin.c:186
    #4 0x404e14 in main /home/zwjj/research/libjpeg-turbo/jpegtran.c:581
    #5 0x7fbfb2ed182f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #6 0x405a58 in _start (/home/zwjj/research/libjpeg-turbo/jpegtran-static+0x405a58)

Address 0x7ffd03285910 is located in stack of thread T0 at offset 384 in frame
    #0 0x4d839f in encode_mcu_huff /home/zwjj/research/libjpeg-turbo/jchuff.c:648

  This frame has 2 object(s):
    [32, 88) 'state'
    [128, 384) '_buffer' <== Memory access at offset 384 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /home/zwjj/research/libjpeg-turbo/jchuff.c:600 encode_one_block
Shadow bytes around the buggy address:
  0x100020648ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100020648ae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100020648af0: 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 f4 f2 f2
  0x100020648b00: f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100020648b10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x100020648b20: 00 00[f3]f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00
  0x100020648b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100020648b40: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00
  0x100020648b50: 00 00 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00
  0x100020648b60: f4 f4 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00
  0x100020648b70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==11652==ABORTING
```

[poc](https://drive.google.com/file/d/1b_1RmtUG4NYUFYAmfRpECliJ-AoIExMD/)



Comments:
Comment by dcommander on 2019-12-05 21:44:58+00:00:
I don't believe that this issue was exploitable, since the overrun was fully contained in the stack (valgrind didn't even detect it) and since the lossless transformer is, unlike the decompressor, not generally exposed to arbitrary data exploits (i.e. it is generally used offline, not online.)  Fixed and pushed.


Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
cmake . -DCMAKE_INSTALL_PREFIX=$WORK -DENABLE_STATIC:bool=on
make "-j$(nproc)"
make install -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool nasm curl cmake
RUN git clone https://github.com/libjpeg-turbo/libjpeg-turbo libjpeg-turbo
RUN git -C libjpeg-turbo checkout 6367924ac62e72fc97e3105c43eb6bd1ec8eead3
WORKDIR $SRC/libjpeg-turbo
COPY build.sh $SRC/

Additional files:
filename: libjpeg_turbo_fuzzer.cc
content: /*
# Copyright 2016 Google Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
################################################################################
*/

#include <stdint.h>
#include <stdlib.h>

#include <memory>

#include <turbojpeg.h>


extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    tjhandle jpegDecompressor = tjInitDecompress();

    int width, height, subsamp, colorspace;
    int res = tjDecompressHeader3(
        jpegDecompressor, data, size, &width, &height, &subsamp, &colorspace);

    // Bail out if decompressing the headers failed, the width or height is 0,
    // or the image is too large (avoids slowing down too much). Cast to size_t to
    // avoid overflows on the multiplication
    if (res != 0 || width == 0 || height == 0 || ((size_t)width * height > (1024 * 1024))) {
        tjDestroy(jpegDecompressor);
        return 0;
    }

    const int buffer_size = width * height * 3;
    std::unique_ptr<unsigned char[]> buf(new unsigned char[buffer_size]);
    tjDecompress2(
        jpegDecompressor, data, size, buf.get(), width, 0, height, TJPF_RGB, 0);

    // For memory sanitizer, test each output byte
    const unsigned char* raw_buf = buf.get();
    int count = 0;
    for( int i = 0; i < buffer_size; i++ )
    {
        if (raw_buf[i])
        {
            count ++;
        }
    }
    if (count == buffer_size)
    {
        // Do something with side effect, so that all the above tests don't
        // get removed by the optimizer.
        free(malloc(1));
    }

    tjDestroy(jpegDecompressor);

    return 0;
}