Project: openjpeg (uclouvain/openjpeg), language: c++
Vulnerability instance: openjpeg.cve-2016-10505
Sanitizer: address

================= Bug Report (1/4) ==================
## Source: GitHub Issue
## URL: https://github.com/uclouvain/openjpeg/issues/776
## Description:
Issue: uclouvain/openjpeg#776
Title: [CVE-2016-10505] Null Pointer Access in function imagetopnm of convert.c
State: closed
Created by: trylab
Created at: 2016-05-06 06:09:25+00:00
Labels: bug, Priority-Critical

Issue Body:
# Title

OpenJPEG Null Pointer Access in function imagetopnm of convert.c
# Testing Environment

Ubuntu + OpenJPEG (GitHub master, 2016/05/06)
# Exception Information

```
==22059== ERROR: AddressSanitizer: SEGV on unknown address 0x00000000 
    (pc 0x0805f813 sp 0xbfd3b8a0 bp 0xbfd3b958 T0)
AddressSanitizer can not provide additional info.
    #0 0x805f812 in imagetopnm /home/trylab/Desktop/repo/openjpeg/src/bin/jp2/convert.c:1974
    #1 0x805279a in main /home/trylab/Desktop/repo/openjpeg/src/bin/jp2/opj_decompress.c:1467
    #2 0xb5e96a82 (/lib/i386-linux-gnu/libc.so.6+0x19a82)
    #3 0x804a150 in _start (/home/trylab/Desktop/repo/openjpeg/bin/opj_decompress+0x804a150)
SUMMARY: AddressSanitizer: SEGV /home/trylab/Desktop/repo/openjpeg/src/bin/jp2/convert.c:1974 imagetopnm
==22059== ABORTING
```
# PoC

https://raw.githubusercontent.com/trylab/PoCs/master/openjpeg/SIGSEGV_Null-Pointer-Access_imagetopnm/poc.j2k
# Credit

Ke Liu of Tencent's Xuanwu LAB



Comments:
Comment by szukw000 on 2016-05-09 15:09:28+00:00:
bin/opj_decompress  -i /tmp/ISSUE-776/issue776-poc.j2k -o issue776-poc.j2k.png

[INFO] Start to read j2k main header (0).
[INFO] Main header has been correctly decoded.
[INFO] No decoded area parameters, set the decoded area to the whole image
Segmentation fault

NAME(/tmp/ISSUE-776/issue776-poc.j2k)
LENG(174)

[51]marker(0xff52)

```
read_cod

         max_len 18
      prog_order 0
       nr_layers 16384
```

[92]marker(0xff64)
    com  len(66)
    R[1](General use (ISO 8859-1 (latin-1) values))
       T(Created by OPJViewer Win32 - OpenJPEG  version 1.2.0 with JPWL)
[160]marker(0xff90)

```
read_sot Psot > 0

tile_nr(0) Psot(1146447479) TPsot(119) TNsot(255)

----------------------
```

Tested with openjpeg-master-2016-05-09.

winfried


---

Comment by rouault on 2017-08-09 09:42:10+00:00:
No longer reproducible with master

``
$ bin/opj_decompress -i ../poc_776.j2k -o out.j2k.pgx

[INFO] Start to read j2k main header (0).
[INFO] Main header has been correctly decoded.
[INFO] No decoded area parameters, set the decoded area to the whole image
[ERROR] Invalid tile part index for tile number 0. Got 119, expected 0
[ERROR] Fail to read the current marker segment (0xff90)
ERROR -> opj_decompress: failed to decode image!
```

================= Bug Report (2/4) ==================
## Source: GitHub Issue
## URL: https://github.com/uclouvain/openjpeg/issues/784
## Description:
Issue: uclouvain/openjpeg#784
Title: [CVE-2016-10505] Null Pointer Access in function sycc444_to_rgb of color.c
State: closed
Created by: trylab
Created at: 2016-05-25 03:47:12+00:00
Labels: bug, Priority-Critical

Issue Body:
# Title

Null Pointer Access in function sycc444_to_rgb of color.c
# Testing Environment

Ubuntu + OpenJPEG (GitHub master, 2016/05/25)
# Exception Information

```
==19455== ERROR: AddressSanitizer: SEGV on unknown address 0x00000000 
    (pc 0x0806ef10 sp 0xbff51d80 bp 0xbff51e08 T0)
AddressSanitizer can not provide additional info.
    #0 0x806ef0f in sycc444_to_rgb openjpeg/src/bin/common/color.c:115
    #1 0x8071a24 in color_sycc_to_rgb openjpeg/src/bin/common/color.c:346
    #2 0x8051fc3 in main openjpeg/src/bin/jp2/opj_decompress.c:1375
    #3 0xb5e7ea82 (/lib/i386-linux-gnu/libc.so.6+0x19a82)
    #4 0x804a150 in _start (openjpeg/bin/opj_decompress+0x804a150)
SUMMARY: AddressSanitizer: SEGV openjpeg/src/bin/common/color.c:115 sycc444_to_rgb
==19455== ABORTING
```
# PoC

https://raw.githubusercontent.com/trylab/PoCs/master/openjpeg/SIGSEGV_Null-Pointer-Access_sycc444_to_rgb/sycc444_to_rgb.j2k
# Credit

Ke Liu of Tencent's Xuanwu LAB



Comments:
Comment by rouault on 2017-08-09 09:41:35+00:00:
No longer reproducible with master

```
$ bin/opj_decompress -i ../sycc444_to_rgb.j2k -o out.j2k.pgx

===========================================
The extension of this file is incorrect.
FOUND .j2k. SHOULD BE .jp2
===========================================

[INFO] Start to read j2k main header (85).
[INFO] Main header has been correctly decoded.
[INFO] No decoded area parameters, set the decoded area to the whole image
[ERROR] Failed to decode tile 1/1
[ERROR] Failed to decode the codestream in the JP2 file
ERROR -> opj_decompress: failed to decode image!
```

================= Bug Report (3/4) ==================
## Source: GitHub Issue
## URL: https://github.com/uclouvain/openjpeg/issues/785
## Description:
Issue: uclouvain/openjpeg#785
Title: [CVE-2016-10505] Null Pointer Access in function color_esycc_to_rgb of color.c
State: closed
Created by: trylab
Created at: 2016-05-25 03:47:58+00:00
Labels: bug, Priority-Critical

Issue Body:
# Title

Null Pointer Access in function color_esycc_to_rgb of color.c
# Testing Environment

Ubuntu + OpenJPEG (GitHub master, 2016/05/25)
# Exception Information

```
==31274== ERROR: AddressSanitizer: SEGV on unknown address 0x00000000 
    (pc 0x08072dd4 sp 0xbfca8780 bp 0xbfca87e8 T0)
AddressSanitizer can not provide additional info.
    #0 0x8072dd3 in color_esycc_to_rgb openjpeg/src/bin/common/color.c:937
    #1 0x80520b2 in main openjpeg/src/bin/jp2/opj_decompress.c:1381
    #2 0xb5e81a82 (/lib/i386-linux-gnu/libc.so.6+0x19a82)
    #3 0x804a150 in _start (openjpeg/bin/opj_decompress+0x804a150)
SUMMARY: AddressSanitizer: SEGV openjpeg/src/bin/common/color.c:937 color_esycc_to_rgb
==31274== ABORTING
```
# PoC

https://raw.githubusercontent.com/trylab/PoCs/master/openjpeg/SIGSEGV_Null-Pointer-Access_color_esycc_to_rgb/color_esycc_to_rgb.j2k
# Credit

Ke Liu of Tencent's Xuanwu LAB



Comments:
Comment by rouault on 2017-08-09 09:41:01+00:00:
No longer reproducible with master

$ bin/opj_decompress -i ../color_esycc_to_rgb.j2k -o out.j2k.pgx

===========================================
The extension of this file is incorrect.
FOUND .j2k. SHOULD BE .jp2
===========================================

[INFO] Start to read j2k main header (85).
[INFO] Main header has been correctly decoded.
[INFO] No decoded area parameters, set the decoded area to the whole image
[ERROR] Failed to decode tile 1/1
[ERROR] Failed to decode the codestream in the JP2 file
ERROR -> opj_decompress: failed to decode image!


================= Bug Report (4/4) ==================
## Source: GitHub Issue
## URL: https://github.com/uclouvain/openjpeg/issues/792
## Description:
Issue: uclouvain/openjpeg#792
Title: [CVE-2016-10505] Null Pointer Access in function sycc422_to_rgb of color.c
State: closed
Created by: trylab
Created at: 2016-06-28 02:15:25+00:00
Labels: bug, Priority-Critical

Issue Body:
# Title

Null Pointer Access in function sycc422_to_rgb of color.c
# Testing Environment

Ubuntu + OpenJPEG (GitHub master, 2016/06/28)
# Exception Information

```
==3793==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000 (pc 0x08164302 bp 0xb4e00770 sp 0xbffd6da0 T0)
    #0 0x8164301 in sycc422_to_rgb ~/Desktop/repo/openjpeg-master/src/bin/common/color.c:169:29
    #1 0x8164301 in color_sycc_to_rgb ~/Desktop/repo/openjpeg-master/src/bin/common/color.c:336
    #2 0x8137a25 in main ~/Desktop/repo/openjpeg-master/src/bin/jp2/opj_decompress.c:1375:4
    #3 0xb7402a82 in __libc_start_main /build/eglibc-617sU_/eglibc-2.19/csu/libc-start.c:287
    #4 0x8077e6b in _start (~/Desktop/repo/openjpeg-master/bin/opj_decompress+0x8077e6b)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ~/Desktop/repo/openjpeg-master/src/bin/common/color.c:169 sycc422_to_rgb
==3793==ABORTING
```
# PoC

https://raw.githubusercontent.com/trylab/PoCs/master/openjpeg/SIGSEGV_Null-Pointer-Access_sycc422_to_rgb/sycc422_to_rgb.j2k
# Credit

Ke Liu of Tencent's Xuanwu LAB



Comments:
Comment by szukw000 on 2016-06-28 05:01:55+00:00:
Another buggy image created with OpenJPEG.

winfried

[sycc422_to_rgb-j2k.txt](https://github.com/uclouvain/openjpeg/files/336304/sycc422_to_rgb-j2k.txt)


---

Comment by boxerab on 2016-07-03 01:28:45+00:00:
Yes, TSOT marker is at the end of the file, so there is no actual tile data. 


---

Comment by mayeut on 2016-07-14 09:22:50+00:00:
Seems to be the same root cause for #785, #784 & #776  


---

Comment by boxerab on 2016-07-21 15:22:10+00:00:
Solution is to return error if no image data is actually decoded


---

Comment by rouault on 2017-08-09 09:42:57+00:00:
No longer reproducible with master

```
$ bin/opj_decompress -i ../sycc422_to_rgb.j2k   -o out.j2k.pgx

[INFO] Start to read j2k main header (0).
[INFO] Main header has been correctly decoded.
[INFO] No decoded area parameters, set the decoded area to the whole image
ERROR -> opj_decompress: no image data!
```

Attachments:
https://github.com/uclouvain/openjpeg/files/336304/sycc422_to_rgb-j2k.txt

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build
cd build
cmake ..
make clean -s -j$(nproc)
make -j$(nproc) -s

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make cmake g++
RUN git clone https://github.com/uclouvain/openjpeg openjpeg
RUN git -C openjpeg checkout 1f1e968269bbd7eaade7955892a6d8c281b91df2
WORKDIR $SRC/openjpeg
COPY build.sh $SRC/

Additional files: