Project: openjpeg (uclouvain/openjpeg), language: c++
Vulnerability instance: openjpeg.cve-2017-14040
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/uclouvain/openjpeg/issues/995
## Description:
Issue: uclouvain/openjpeg#995
Title: invalid memory write in tgatoimage (convert.c)
State: closed
Created by: asarubbo
Created at: 2017-08-17 08:59:55+00:00

Issue Body:
On master:

```
# opj_compress -r 20,10,1 -jpip -EPH -SOP -cinema2K 24 -n 1 -i $FILE -o null.j2k
ASAN:DEADLYSIGNAL                                                                                                                                                                                                 
=================================================================                                                                                                                                                 
==13239==ERROR: AddressSanitizer: SEGV on unknown address 0x7f4f2e9b4800 (pc 0x00000052264a bp 0x7ffff176def0 sp 0x7ffff176dde0 T0)                                                                               
==13239==The signal is caused by a WRITE memory access.                                                                                                                                                           
    #0 0x522649 in tgatoimage /var/tmp/portage/media-libs/openjpeg-9999/work/openjpeg-9999/src/bin/jp2/convert.c:928:45                                                                                           
    #1 0x50b4e6 in main /var/tmp/portage/media-libs/openjpeg-9999/work/openjpeg-9999/src/bin/jp2/opj_compress.c:1881:21                                                                                           
    #2 0x7f5de2316680 in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.23-r4/work/glibc-2.23/csu/../csu/libc-start.c:289                                                                                    
    #3 0x41bc18 in _start (/usr/bin/opj_compress+0x41bc18)                                                                                                                                                        
                                                                                                                                                                                                                  
AddressSanitizer can not provide additional info.                                                                                                                                                                 
SUMMARY: AddressSanitizer: SEGV /var/tmp/portage/media-libs/openjpeg-9999/work/openjpeg-9999/src/bin/jp2/convert.c:928:45 in tgatoimage                                                                           
==13239==ABORTING                                                                                                                                                                                                 
CINEMA 2K profile activated                                                                                                                                                                                       
Other options specified could be overridden
```

Testcase:
https://github.com/asarubbo/poc/blob/master/00326-openjpeg-invalidwrite-tgatoimage


Comments:
Comment by carnil on 2017-09-03 13:17:17+00:00:
This issue has been allocated CVE-2017-14040

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build
cd build
cmake ..
make clean -s -j$(nproc)
make -j$(nproc) -s

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make cmake g++
RUN git clone https://github.com/uclouvain/openjpeg openjpeg
RUN git -C openjpeg checkout 09e83407fa2b53c606d3179031b8d8b31272e20c
WORKDIR $SRC/openjpeg
COPY build.sh $SRC/

Additional files: