Project: openjpeg (uclouvain/openjpeg), language: c++
Vulnerability instance: openjpeg.cve-2016-9115
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/uclouvain/openjpeg/issues/858
## Description:
Issue: uclouvain/openjpeg#858
Title: Heap Buffer Overflow in function imagetotga of convert.c(jp2):942
State: closed
Created by: YangY-Xiao
Created at: 2016-10-29 08:45:59+00:00

Issue Body:
**DESCRIPTION**
OPENJPEG Heap Buffer Overflow in function imagetotga of convert.c(jp2):942.

**VERSION**
OPENJPEG-2.1.2

**Address Sanitizer Output**
==5085==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xb4a01754 at pc 0x08141b20 bp 0xbfcb8de8 sp 0xbfcb8ddc
READ of size 4 at 0xb4a01754 thread T0
    #0 0x8141b1f  (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x8141b1f)
    #1 0x813731a  (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x813731a)
    #2 0xb7448636  (/lib/i386-linux-gnu/libc.so.6+0x18636)
    #3 0x805f327  (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x805f327)

0xb4a01754 is located 12 bytes to the left of 52-byte region [0xb4a01760,0xb4a01794)
allocated by thread T0 here:
    #0 0x81037f4  (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x81037f4)
    #1 0xb7731e0c  (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/libopenjp2.so.7+0x99e0c)
    #2 0xb772525f  (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/libopenjp2.so.7+0x8d25f)
    #3 0xb76cb12a  (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/libopenjp2.so.7+0x3312a)
    #4 0xb76b853a  (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/libopenjp2.so.7+0x2053a)
    #5 0xb76b8064  (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/libopenjp2.so.7+0x20064)
    #6 0xb76faa66  (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/libopenjp2.so.7+0x62a66)
    #7 0x8136785  (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x8136785)
    #8 0xb7448636  (/lib/i386-linux-gnu/libc.so.6+0x18636)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x8141b1f) 
Shadow bytes around the buggy address:
  0x36940290: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x369402a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x369402b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x369402c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x369402d0: fa fa fa fa 00 00 00 00 00 00 04 fa fa fa fa fa
=>0x369402e0: 00 00 00 00 00 00 04 fa fa fa[fa]fa 00 00 00 00
  0x369402f0: 00 00 04 fa fa fa fa fa 00 00 00 00 00 00 04 fa
  0x36940300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36940310: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36940320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36940330: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

**Analysis**
come soon

**Poc**
Contact me if you need Poc file at YangX92@hotmail.com



Comments:
Comment by 1ucian0 on 2016-12-03 04:54:08+00:00:
Please, refer to this issue as CVE-2016-9115

---

Comment by rouault on 2017-08-09 08:07:02+00:00:
@Young-X Please verify if that occurs still with latest master. If so, please attach the reproducer to the ticket

---

Comment by carnil on 2017-09-23 07:09:28+00:00:
@Young-X can you please provide the reproducer?

---

Comment by YangY-Xiao on 2017-10-24 01:27:21+00:00:
There is no crash with latest version and PoC that triggered #858.
Sorry for replying late.

---

Comment by carnil on 2017-10-29 09:30:52+00:00:
Hi

On Tue, Oct 24, 2017 at 01:27:23AM +0000, Young-X wrote:
> There is no crash with latest version and PoC that triggered #858.
> Sorry for replying late.

Thanks for confirming.

Can you please still provide the reproducer?


Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build
cd build
cmake ..
make clean -s -j$(nproc)
make -j$(nproc) -s

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make cmake g++
RUN git clone https://github.com/uclouvain/openjpeg openjpeg
RUN git -C openjpeg checkout 1f1e968269bbd7eaade7955892a6d8c281b91df2
WORKDIR $SRC/openjpeg
COPY build.sh $SRC/

Additional files: