Project: openjpeg (uclouvain/openjpeg), language: c++
Vulnerability instance: openjpeg.cve-2016-9114
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/uclouvain/openjpeg/issues/857
## Description:
Issue: uclouvain/openjpeg#857
Title: NULL Pointer Access in function imagetopnm of convert.c:1943(jp2)
State: open
Created by: YangY-Xiao
Created at: 2016-10-29 08:19:23+00:00

Issue Body:
**DESCRIPTION**
OPENJPEG null ptr dereference in convertbmp.c:980

**VERSION**
OPENJPEG-2.1.2

**Address Sanitizer Output**
==3411==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000 (pc 0x08146eaf bp 0xbfc960a8 sp 0xbfc96040 T0)
    #0 0x8146eae  (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x8146eae)
    #1 0x813715c  (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x813715c)
    #2 0xb7403636  (/lib/i386-linux-gnu/libc.so.6+0x18636)
    #3 0x805f327  (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x805f327)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x8146eae)

GDB Information
Breakpoint 4, imagetopnm (image=0x8d2d5c0, outfile=0xbfb08654 "image.pnm", force_split=0)
    at /home/yang/openjpeg/openjpeg-2.1.2/src/bin/jp2/convert.c:1935
1935            red = image->comps[compno].data;
(rr) p red
$7 = (int *) 0xbfb05558
(rr) p image->comps[compno].data
$8 = (OPJ_INT32 *) 0x0
(rr) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x08051b76 in imagetopnm (image=0x8d2d5c0, outfile=0xbfb08654 "image.pnm", force_split=0)
    at /home/yang/openjpeg/openjpeg-2.1.2/src/bin/jp2/convert.c:1943
1943                    v = *red + adjustR; ++red;

**Analysis**
image->comps[compno].data = NULL and it was assigned to red, so the program accesses to red, segment fault occurs.

**Poc**
Contact me if you need Poc file at YangX92@hotmail.com



Comments:
Comment by 1ucian0 on 2016-12-03 04:54:36+00:00:
Please, refer to this issue as CVE-2016-9114

---

Comment by rouault on 2017-08-09 08:07:08+00:00:
@Young-X Please verify if that occurs still with latest master. If so, please attach the reproducer to the ticket

---

Comment by carnil on 2017-09-23 07:09:40+00:00:
@Young-X can you please provide the reproducer?

---

Comment by YangY-Xiao on 2017-10-24 01:26:23+00:00:
There is no crash with latest version and PoC that triggered #857.
Sorry for replying late.

---

Comment by carnil on 2017-10-29 09:30:02+00:00:
Hi

On Tue, Oct 24, 2017 at 01:26:25AM +0000, Young-X wrote:
> There is no crash with latest version and PoC that triggered #857.
> Sorry for replying late.

Thanks for confirming.

Can you please still provide the reproducer file?


Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build
cd build
cmake ..
make clean -s -j$(nproc)
make -j$(nproc) -s

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make cmake g++
RUN git clone https://github.com/uclouvain/openjpeg openjpeg
RUN git -C openjpeg checkout 1f1e968269bbd7eaade7955892a6d8c281b91df2
WORKDIR $SRC/openjpeg
COPY build.sh $SRC/

Additional files: