Project: libjpeg-turbo (libjpeg-turbo/libjpeg-turbo), language: c++
Vulnerability instance: libjpeg-turbo.cve-2017-15232
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/mozilla/mozjpeg/issues/268
## Description:
Issue: mozilla/mozjpeg#268
Title: NULL Pointer Dereference vulneribility in quantize_ord_dither function of mozjpeg
State: open
Created by: leonzhao7
Created at: 2017-09-30 02:36:55+00:00

Issue Body:
## Command and argument
djpeg -crop "1x1+16+16" -onepass -dither ordered -dct float -colors 8 -targa -grayscale -outfile o [infile]
## Crash Information
The output of djpeg with address sanitizer enabled
```
./djpeg -crop "1x1+16+16" -onepass -dither ordered -dct float -colors 8 -targa -grayscale -outfile o /root/fuzz/mozjpeg/output/moz-fuzz02/crashes/001-mozjpeg-quantize_ord_dither-536.crash 
Corrupt JPEG data: 94 extraneous bytes before marker 0xdd
ASAN:SIGSEGV
=================================================================
==51824==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7fb8a48a9302 bp 0x7ffe5825e380 sp 0x7ffe5825db08 T0)
    #0 0x7fb8a48a9301  (/lib/x86_64-linux-gnu/libc.so.6+0x8f301)
    #1 0x7fb8a4fe7b1e in __asan_memset (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8cb1e)
    #2 0x7fb8a4cf3736 in jzero_far /root/mozjpeg/jutils.c:132
    #3 0x7fb8a4ce99f7 in quantize_ord_dither /root/mozjpeg/jquant1.c:536
    #4 0x7fb8a4cc2772 in post_process_1pass /root/mozjpeg/jdpostct.c:145
    #5 0x7fb8a4c91f0e in process_data_simple_main /root/mozjpeg/jdmainct.c:311
    #6 0x7fb8a4c6a16c in jpeg_read_scanlines /root/mozjpeg/jdapistd.c:282
    #7 0x404c89 in main /root/mozjpeg/djpeg.c:731
    #8 0x7fb8a483a82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #9 0x4018e8 in _start (/opt/asan/bin/djpeg+0x4018e8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ??:0 ??
==51824==ABORTING
```
and the second POC file, i think thay should be a same vulneribility.
```
./djpeg -crop "1x1+16+16" -onepass -dither ordered -dct float -colors 8 -targa -grayscale -outfile o /root/fuzz/mozjpeg/output/moz-fuzz02/crashes/002-mozjpeg-quantize_ord_dither-536.crash 
ASAN:SIGSEGV
=================================================================
==43339==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f7c8450a9ea bp 0x7ffea3850b70 sp 0x7ffea3850b00 T0)
    #0 0x7f7c8450a9e9 in quantize_ord_dither /root/mozjpeg/jquant1.c:536
    #1 0x7f7c844e3772 in post_process_1pass /root/mozjpeg/jdpostct.c:145
    #2 0x7f7c844b2f0e in process_data_simple_main /root/mozjpeg/jdmainct.c:311
    #3 0x7f7c8448b16c in jpeg_read_scanlines /root/mozjpeg/jdapistd.c:282
    #4 0x7f7c8448b307 in read_and_discard_scanlines /root/mozjpeg/jdapistd.c:316
    #5 0x7f7c8448b4d1 in increment_simple_rowgroup_ctr /root/mozjpeg/jdapistd.c:342
    #6 0x7f7c8448c6d4 in jpeg_skip_scanlines /root/mozjpeg/jdapistd.c:504
    #7 0x404bff in main /root/mozjpeg/djpeg.c:729
    #8 0x7f7c8405b82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #9 0x4018e8 in _start (/opt/asan/bin/djpeg+0x4018e8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/mozjpeg/jquant1.c:536 quantize_ord_dither
==43339==ABORTING
```
## POC file
[mozjpeg-quantize_ord_dither-crash.zip](https://github.com/mozilla/mozjpeg/files/1346042/mozjpeg-quantize_ord_dither-crash.zip)
## CREDIT
Zhao Liang, Huawei Weiran Labs


Attachments:
https://github.com/mozilla/mozjpeg/files/1346042/mozjpeg-quantize_ord_dither-crash.zip

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
autoreconf -fiv
./configure
make "-j$(nproc)"

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool nasm curl
RUN git clone https://github.com/libjpeg-turbo/libjpeg-turbo libjpeg-turbo
RUN git -C libjpeg-turbo checkout e5c1613ccdfeffcd060fd94248b7c8ac7c0cfb0f
WORKDIR $SRC/libjpeg-turbo
COPY build.sh $SRC/

Additional files:
filename: libjpeg_turbo_fuzzer.cc
content: /*
# Copyright 2016 Google Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
################################################################################
*/

#include <stdint.h>
#include <stdlib.h>

#include <memory>

#include <turbojpeg.h>


extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    tjhandle jpegDecompressor = tjInitDecompress();

    int width, height, subsamp, colorspace;
    int res = tjDecompressHeader3(
        jpegDecompressor, data, size, &width, &height, &subsamp, &colorspace);

    // Bail out if decompressing the headers failed, the width or height is 0,
    // or the image is too large (avoids slowing down too much). Cast to size_t to
    // avoid overflows on the multiplication
    if (res != 0 || width == 0 || height == 0 || ((size_t)width * height > (1024 * 1024))) {
        tjDestroy(jpegDecompressor);
        return 0;
    }

    std::unique_ptr<unsigned char[]> buf(new unsigned char[width * height * 3]);
    tjDecompress2(
        jpegDecompressor, data, size, buf.get(), width, 0, height, TJPF_RGB, 0);

    tjDestroy(jpegDecompressor);

    return 0;
}