Project: openjpeg (uclouvain/openjpeg), language: c++
Vulnerability instance: openjpeg.cve-2016-3183
Sanitizer: address

================= Bug Report (1/2) ==================
## Source: Red Hat Bugzilla
## URL: https://bugzilla.redhat.com/show_bug.cgi?id=1317821
## Description:
Bugzilla ID: 1317821
Title: CVE-2016-3183 openjpeg: Out-of-bounds read in sycc422_to_rgb function

Description
Adam Mariš 2016-03-15 10:08:32 UTC
n our-of-bounds read vulnerability in sycc422_to_rgb function triggered by specially crafted JPEG2000 image file was found in openjpeg version 2016.03.14.

CVE request (contains reproducer):

http://seclists.org/oss-sec/2016/q1/632


Comments:
Comment 1
Adam Mariš 2016-03-15 10:19:39 UTC
Created mingw-openjpeg2 tracking bugs for this issue:

Affects: fedora-all [bug 1317831]

---

Comment 2
Adam Mariš 2016-03-15 10:19:45 UTC
Created openjpeg2 tracking bugs for this issue:

Affects: fedora-all [bug 1317830]
Affects: epel-all [bug 1317832]

---

Comment 3
Andrej Nemec 2016-03-17 08:22:22 UTC
CVE assignment:

http://seclists.org/oss-sec/2016/q1/668

---

Comment 4
Sandro Mani 2016-05-04 11:40:07 UTC
Patch: https://github.com/uclouvain/openjpeg/commit/15f081c89650dccee4aa4ae66f614c3fdb268767

---

Comment 5
Fedora Update System 2016-07-14 14:51:46 UTC
openjpeg2-2.1.1-1.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

================= Bug Report (2/2) ==================
## Source: GitHub Issue
## URL: https://github.com/uclouvain/openjpeg/issues/726
## Description:
Issue: uclouvain/openjpeg#726
Title: CVE-2016-3183 Out-Of-Bounds Read in sycc422_to_rgb function
State: closed
Created by: trylab
Created at: 2016-03-16 10:05:56+00:00
Labels: bug, Priority-Critical

Issue Body:
AddressSanitizer error message.

```
==116421==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x633000018c00 
at pc 0x000000529f98 bp 0x7ffe75bda580 sp 0x7ffe75bda578
READ of size 4 at 0x633000018c00 thread T0
    #0 0x529f97 in sycc422_to_rgb openjpeg/src/bin/common/color.c:148:33
    #1 0x527625 in color_sycc_to_rgb openjpeg/src/bin/common/color.c:286:3
    #2 0x4f1f5b in main openjpeg/src/bin/jp2/opj_decompress.c:1375:4
    #3 0x7f14c593182f in __libc_start_main /build/glibc-GKVZIf/glibc-2.23/csu/../csu/libc-start.c:291
    #4 0x41a978 in _start (openjpeg/bin/opj_decompress+0x41a978)

0x633000018c00 is located 0 bytes to the right of 99328-byte region [0x633000000800,0x633000018c00)
allocated by thread T0 here:
    #0 0x4bac30 in calloc (openjpeg/bin/opj_decompress+0x4bac30)
    #1 0x7f14c722d764 in opj_calloc openjpeg/src/lib/openjp2/opj_malloc.c:203:10
    #2 0x7f14c71a0e7a in opj_j2k_update_image_data openjpeg/src/lib/openjp2/j2k.c:8212:62
    #3 0x7f14c71a0886 in opj_j2k_decode_tiles openjpeg/src/lib/openjp2/j2k.c:9752:23
    #4 0x7f14c71693fd in opj_j2k_exec openjpeg/src/lib/openjp2/j2k.c:7341:41
    #5 0x7f14c717c44e in opj_j2k_decode openjpeg/src/lib/openjp2/j2k.c:9943:15
    #6 0x7f14c71d4356 in opj_decode openjpeg/src/lib/openjp2/openjpeg.c:412:10
    #7 0x4f1627 in main openjpeg/src/bin/jp2/opj_decompress.c:1330:10
    #8 0x7f14c593182f in __libc_start_main /build/glibc-GKVZIf/glibc-2.23/csu/../csu/libc-start.c:291

SUMMARY: AddressSanitizer: heap-buffer-overflow openjpeg/src/bin/common/color.c:148:33 in sycc422_to_rgb
Shadow bytes around the buggy address:
  0x0c667fffb130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c667fffb140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c667fffb150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c667fffb160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c667fffb170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c667fffb180:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c667fffb190: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c667fffb1a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c667fffb1b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c667fffb1c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c667fffb1d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==116421==ABORTING
```

Credit to **Ke Liu of Tencent's Xuanwu LAB**.



Comments:
Comment by boxerab on 2016-03-31 03:42:19+00:00:
kdu_show crashes when trying to read this image.


Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build
cd build
cmake ..
make clean -s -j$(nproc)
make -j$(nproc) -s

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make cmake g++
RUN git clone https://github.com/uclouvain/openjpeg openjpeg
RUN git -C openjpeg checkout ad593c9e0622e0d8d87228e67e4dbd36243ffd22
WORKDIR $SRC/openjpeg
COPY build.sh $SRC/

Additional files: