Project: openjpeg (uclouvain/openjpeg), language: c++
Vulnerability instance: openjpeg.cve-2016-9116
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/uclouvain/openjpeg/issues/859
## Description:
Issue: uclouvain/openjpeg#859
Title: NULL Pointer Access in function imagetopnm of convert.c:2226(jp2) 
State: closed
Created by: YangY-Xiao
Created at: 2016-10-29 08:53:27+00:00

Issue Body:
**DESCRIPTION**
OPENJPEG null ptr dereference in convertbmp.c:2226

**VERSION**
OPENJPEG-2.1.2

**Address Sanitizer Output**
==25769==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000 (pc 0x0814979f bp 0xbfe95808 sp 0xbfe95720 T0)
    #0 0x814979e  (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x814979e)
    #1 0x81372ce  (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x81372ce)
    #2 0xb7466636  (/lib/i386-linux-gnu/libc.so.6+0x18636)
    #3 0x805f327  (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x805f327)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x814979e)

**GDB Information**
Breakpoint 1, imagetoraw_common (image=0x9a065c0, outfile=0xbf8b9204 "image.raw", big_endian=1)
    at /home/yang/openjpeg/openjpeg-2.1.2/src/bin/jp2/convert.c:2223
2223                    ptr = image->comps[compno].data;
(rr) p image->comps[compno].data 
$2 = (OPJ_INT32 *) 0x0
(rr) n
2224                    for (line = 0; line < h; line++) {
(rr) n
2225                        for(row = 0; row < w; row++)    {
(rr) n
2226                            curr = *ptr;
(rr) n

Program received signal SIGSEGV, Segmentation fault.
0x080528f5 in imagetoraw_common (image=0x9a065c0, outfile=0xbf8b9204 "image.raw", big_endian=1)
    at /home/yang/openjpeg/openjpeg-2.1.2/src/bin/jp2/convert.c:2226
2226                            curr = *ptr;

**Analysis**
image->comps[compno].data = NULL and it was assigned to ptr, so the program accesses to ptr, segment fault occurs.

**Poc**
Contact me if you need Poc file at YangX92@hotmail.com



Comments:
Comment by 1ucian0 on 2016-12-03 04:53:47+00:00:
Please, refer to this issue as CVE-2016-9116

---

Comment by rouault on 2017-08-09 08:06:57+00:00:
@Young-X Please verify if that occurs still with latest master. If so, please attach the reproducer to the ticket

---

Comment by carnil on 2017-09-23 07:09:18+00:00:
@Young-X can you please provide the reproducer?

---

Comment by YangY-Xiao on 2017-10-24 01:28:18+00:00:
There is no crash with latest version and PoC that triggered #859.
Sorry for replying late.

---

Comment by carnil on 2017-10-29 09:31:27+00:00:
Hi

On Mon, Oct 23, 2017 at 06:28:19PM -0700, Young-X wrote:
> There is no crash with latest version and PoC that triggered #859.
> Sorry for replying late.

Thanks for confirming.

Can you please still provide the reproducer?


---

Comment by YangY-Xiao on 2017-11-08 06:22:32+00:00:
https://github.com/Young-X/pocs/tree/master/OpenJPEG_POC 


Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build
cd build
cmake ..
make clean -s -j$(nproc)
make -j$(nproc) -s

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make cmake g++
RUN git clone https://github.com/uclouvain/openjpeg openjpeg
RUN git -C openjpeg checkout 1f1e968269bbd7eaade7955892a6d8c281b91df2
WORKDIR $SRC/openjpeg
COPY build.sh $SRC/

Additional files: