Project: openjpeg (uclouvain/openjpeg), language: c++
Vulnerability instance: openjpeg.cve-2016-7445
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/uclouvain/openjpeg/issues/843
## Description:
Issue: uclouvain/openjpeg#843
Title: null ptr dereference in convert.c:1331
State: closed
Created by: STARLABSEC
Created at: 2016-09-16 09:51:59+00:00
Labels: bug

Issue Body:
# Vulnerability

openjpeg null ptr dereference in convert.c:1331
# Version

git head version  ( https://github.com/uclouvain/openjpeg/ )
# Address Sanitizer Output
# ASAN:SIGSEGV

==7358==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000 (pc 0x0815d204 bp 0xff846938 sp 0xff846380 T0)
    #0 0x815d203 in skip_white /home/starlab/fuzzing/openjpeg/src/bin/jp2/convert.c:1331
    #1 0x8135d81 in main /home/starlab/fuzzing/openjpeg/src/bin/jp2/opj_compress.c:1723
    #2 0xf7343636 in __libc_start_main ??:?
    #3 0x807a31b in _start ??:?
# PoC

See poc.ppm
# Analysis

In convert.c:1483 and convert.c:1485, variable s is uncheck after skip_int is called.
A null ptr will be passed to skip_int again and will cause a null ptr dereference.
# Report Timeline

2016-09-16: FB3F15 of STARLAB discovered this issue
# Credit

FB3F15 of STARLAB
# PoC

Contact us if you need PoC file



Comments:
Comment by szukw000 on 2016-09-17 17:39:32+00:00:
@STARLABSEC ,
can you upload that file or give a link to that file?

winfried


---

Comment by STARLABSEC on 2016-09-18 05:14:55+00:00:
@szukw000 
https://github.com/STARLABSEC/pocs/raw/master/openjpeg-nullptr-github-issue-842.ppm


---

Comment by szukw000 on 2016-09-18 10:11:22+00:00:
@STARLABSEC,

did you yourself change the PPM file? Or did OpenJPEG-2.0.0 create that file?
The ppm.dif shows the bug.

After changing 'convert.c' I got the message:

bin/opj_compress -i openjpeg-nullptr-github-issue-842.ppm -o out.j2k

convert.c:1586:OK(0) width(255) height(0) depth(0)
Unable to load pnm file

The respective patch should be applied.

winfried

[openjpeg-nullptr-github-issue-842.ppm-dif.txt](https://github.com/uclouvain/openjpeg/files/478630/openjpeg-nullptr-github-issue-842.ppm-dif.txt)


---

Comment by STARLABSEC on 2016-09-18 10:25:44+00:00:
@szukw000 
We created it by ourselves.
The patch is ok, please apply it.


---

Comment by szukw000 on 2016-09-18 12:30:41+00:00:
@stweil ,

the patch is applied. I failed to create a github patch.

winfried
[fixpnmtoimage_dif.txt](https://github.com/uclouvain/openjpeg/files/478694/fixpnmtoimage_dif.txt)


---

Comment by mayeut on 2016-09-21 22:31:56+00:00:
@STARLABSEC Thanks fix committed.


---

Comment by fgeek on 2020-10-03 06:55:44+00:00:
CVE-2016-7445 was assigned for this issue in https://www.openwall.com/lists/oss-security/2016/09/18/6

Attachments:
https://github.com/uclouvain/openjpeg/files/478630/openjpeg-nullptr-github-issue-842.ppm-dif.txt
https://github.com/uclouvain/openjpeg/files/478694/fixpnmtoimage_dif.txt

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build
cd build
cmake ..
make clean -s -j$(nproc)
make -j$(nproc) -s

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make cmake g++
RUN git clone https://github.com/uclouvain/openjpeg openjpeg
RUN git -C openjpeg checkout 53f25200ed696cf5dc71d5fe12faad2570861b20
WORKDIR $SRC/openjpeg
COPY build.sh $SRC/

Additional files: