Commit message: CVE-2008-3522
CVE: CVE-2008-3522
CWE: CWE-119
Vulnerability description: Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf.

Project: jasper
File: jas_stream.c

int jas_stream_gobble(jas_stream_t *stream, int n)
{
	int m;
	m = n;
	for (m = n; m > 0; --m) {
		if (jas_stream_getc(stream) == EOF) {
			return n - m;
		}
	}
	return n;
}

Project: jasper
File: jas_stream.c

int jas_stream_printf(jas_stream_t *stream, const char *fmt, ...)
{
	va_list ap;
	char buf[4096];
	int ret;

	va_start(ap, fmt);
	ret = vsnprintf(buf, sizeof buf, fmt, ap);
	jas_stream_puts(stream, buf);
	va_end(ap);
	return ret;
}

Project: jasper
File: jas_stream.c

int jas_stream_display(jas_stream_t *stream, FILE *fp, int n)
{
	unsigned char buf[16];
	int i;
	int j;
	int m;
	int c;
	int display;
	int cnt;

	cnt = n - (n % 16);
	display = 1;

	for (i = 0; i < n; i += 16) {
		if (n > 16 && i > 0) {
			display = (i >= cnt) ? 1 : 0;
		}
		if (display) {
			fprintf(fp, "%08x:", i);
		}
		m = JAS_MIN(n - i, 16);
		for (j = 0; j < m; ++j) {
			if ((c = jas_stream_getc(stream)) == EOF) {
				abort();
				return -1;
			}
			buf[j] = c;
		}
		if (display) {
			for (j = 0; j < m; ++j) {
				fprintf(fp, " %02x", buf[j]);
			}
			fputc(' ', fp);
			for (; j < 16; ++j) {
				fprintf(fp, "   ");
			}
			for (j = 0; j < m; ++j) {
				if (isprint(buf[j])) {
					fputc(buf[j], fp);
				} else {
					fputc(' ', fp);
				}
			}
			fprintf(fp, "\n");
		}


	}
	return 0;
}

Project: jasper
File: jas_stream.c

long jas_stream_length(jas_stream_t *stream)
{
	long oldpos;
	long pos;
	if ((oldpos = jas_stream_tell(stream)) < 0) {
		return -1;
	}
	if (jas_stream_seek(stream, 0, SEEK_END) < 0) {
		return -1;
	}
	if ((pos = jas_stream_tell(stream)) < 0) {
		return -1;
	}
	if (jas_stream_seek(stream, oldpos, SEEK_SET) < 0) {
		return -1;
	}
	return pos;
}

Project: jasper
File: jas_stream.c

long jas_stream_setrwcount(jas_stream_t *stream, long rwcnt)
{
	int old;

	old = stream->rwcnt_;
	stream->rwcnt_ = rwcnt;
	return old;
}

Project: jasper
File: jas_stream.c

int jas_stream_putc_func(jas_stream_t *stream, int c)
{
	assert(stream->ptr_ - stream->bufstart_ <= stream->bufsize_);
	return jas_stream_putc_macro(stream, c);
}

Project: jasper
File: jas_stream.c

static int mem_write(jas_stream_obj_t *obj, char *buf, int cnt)
{
	int n;
	int ret;
	jas_stream_memobj_t *m = (jas_stream_memobj_t *)obj;
	long newbufsize;
	long newpos;

	newpos = m->pos_ + cnt;
	if (newpos > m->bufsize_ && m->growable_) {
		newbufsize = m->bufsize_;
		while (newbufsize < newpos) {
			newbufsize <<= 1;
			assert(newbufsize >= 0);
		}
		if (mem_resize(m, newbufsize)) {
			return -1;
		}
	}
	if (m->pos_ > m->len_) {
		/* The current position is beyond the end of the file, so
		  pad the file to the current position with zeros. */
		n = JAS_MIN(m->pos_, m->bufsize_) - m->len_;
		if (n > 0) {
			memset(&m->buf_[m->len_], 0, n);
			m->len_ += n;
		}
		if (m->pos_ != m->len_) {
			/* The buffer is not big enough. */
			return 0;
		}
	}
	n = m->bufsize_ - m->pos_;
	ret = JAS_MIN(n, cnt);
	if (ret > 0) {
		memcpy(&m->buf_[m->pos_], buf, ret);
		m->pos_ += ret;
	}
	if (m->pos_ > m->len_) {
		m->len_ = m->pos_;
	}
assert(ret == cnt);
	return ret;
}

Project: jasper
File: jas_stream.c

static jas_stream_t *jas_stream_create()
{
	jas_stream_t *stream;

	if (!(stream = jas_malloc(sizeof(jas_stream_t)))) {
		return 0;
	}
	stream->openmode_ = 0;
	stream->bufmode_ = 0;
	stream->flags_ = 0;
	stream->bufbase_ = 0;
	stream->bufstart_ = 0;
	stream->bufsize_ = 0;
	stream->ptr_ = 0;
	stream->cnt_ = 0;
	stream->ops_ = 0;
	stream->obj_ = 0;
	stream->rwcnt_ = 0;
	stream->rwlimit_ = -1;

	return stream;
}

Project: jasper
File: jas_stream.c

int jas_stream_write(jas_stream_t *stream, const void *buf, int cnt)
{
	int n;
	const char *bufptr;

	bufptr = buf;

	n = 0;
	while (n < cnt) {
		if (jas_stream_putc(stream, *bufptr) == EOF) {
			return n;
		}
		++bufptr;
		++n;
	}

	return n;
}

Project: jasper
File: jas_stream.c

int jas_stream_copy(jas_stream_t *out, jas_stream_t *in, int n)
{
	int all;
	int c;
	int m;

	all = (n < 0) ? 1 : 0;

	m = n;
	while (all || m > 0) {
		if ((c = jas_stream_getc_macro(in)) == EOF) {
			/* The next character of input could not be read. */
			/* Return with an error if an I/O error occured
			  (not including EOF) or if an explicit copy count
			  was specified. */
			return (!all || jas_stream_error(in)) ? (-1) : 0;
		}
		if (jas_stream_putc_macro(out, c) == EOF) {
			return -1;
		}
		--m;
	}
	return 0;
}

Project: jasper
File: jas_stream.c

int jas_stream_isseekable(jas_stream_t *stream)
{
	if (stream->ops_ == &jas_stream_memops) {
		return 1;
	} else if (stream->ops_ == &jas_stream_fileops) {
		if ((*stream->ops_->seek_)(stream->obj_, 0, SEEK_CUR) < 0) {
			return 0;
		}
		return 1;
	} else {
		return 0;
	}
}

Project: jasper
File: jas_stream.c

int jas_stream_read(jas_stream_t *stream, void *buf, int cnt)
{
	int n;
	int c;
	char *bufptr;

	bufptr = buf;

	n = 0;
	while (n < cnt) {
		if ((c = jas_stream_getc(stream)) == EOF) {
			return n;
		}
		*bufptr++ = c;
		++n;
	}

	return n;
}

Project: jasper
File: jas_stream.c

int jas_stream_fillbuf(jas_stream_t *stream, int getflag)
{
	int c;

	/* The stream must not be in an error or EOF state. */
	if ((stream->flags_ & (JAS_STREAM_ERRMASK)) != 0) {
		return EOF;
	}

	/* The stream must be open for reading. */
	if ((stream->openmode_ & JAS_STREAM_READ) == 0) {
		return EOF;
	}

	/* Make a half-hearted attempt to confirm that the buffer is not
	currently being used for writing.  This check is not intended
	to be foolproof! */
	assert((stream->bufmode_ & JAS_STREAM_WRBUF) == 0);

	assert(stream->ptr_ - stream->bufstart_ <= stream->bufsize_);

	/* Mark the buffer as being used for reading. */
	stream->bufmode_ |= JAS_STREAM_RDBUF;

	/* Read new data into the buffer. */
	stream->ptr_ = stream->bufstart_;
	if ((stream->cnt_ = (*stream->ops_->read_)(stream->obj_,
	  (char *) stream->bufstart_, stream->bufsize_)) <= 0) {
		if (stream->cnt_ < 0) {
			stream->flags_ |= JAS_STREAM_ERR;
		} else {
			stream->flags_ |= JAS_STREAM_EOF;
		}
		stream->cnt_ = 0;
		return EOF;
	}

	assert(stream->cnt_ > 0);
	/* Get or peek at the first character in the buffer. */
	c = (getflag) ? jas_stream_getc2(stream) : (*stream->ptr_);

	return c;
}

Project: jasper
File: jas_stream.c

int jas_stream_ungetc(jas_stream_t *stream, int c)
{
	if (!stream->ptr_ || stream->ptr_ == stream->bufbase_) {
		return -1;
	}

	/* Reset the EOF indicator (since we now have at least one character
	  to read). */
	stream->flags_ &= ~JAS_STREAM_EOF;

	--stream->rwcnt_;
	--stream->ptr_;
	++stream->cnt_;
	*stream->ptr_ = c;
	return 0;
}

Project: jasper
File: jas_stream.c

int jas_stream_getc_func(jas_stream_t *stream)
{
	assert(stream->ptr_ - stream->bufbase_ <= stream->bufsize_ +
	  JAS_STREAM_MAXPUTBACK);
	return jas_stream_getc_macro(stream);
}

Project: jasper
File: jas_stream.c

int jas_stream_puts(jas_stream_t *stream, const char *s)
{
	while (*s != '\0') {
		if (jas_stream_putc_macro(stream, *s) == EOF) {
			return -1;
		}
		++s;
	}
	return 0;
}

Project: jasper
File: jas_stream.c

int jas_stream_pad(jas_stream_t *stream, int n, int c)
{
	int m;
	m = n;
	for (m = n; m > 0; --m) {
		if (jas_stream_putc(stream, c) == EOF)
			return n - m;
	}
	return n;
}

Project: jasper
File: jas_stream.c

int jas_stream_flushbuf(jas_stream_t *stream, int c)
{
	int len;
	int n;

	/* The stream should not be in an error or EOF state. */
	if ((stream->flags_ & (JAS_STREAM_ERRMASK)) != 0) {
		return EOF;
	}

	/* The stream must be open for writing. */
	if ((stream->openmode_ & (JAS_STREAM_WRITE | JAS_STREAM_APPEND)) == 0) {
		return EOF;
	}

	/* The buffer should not currently be in use for reading. */
	assert(!(stream->bufmode_ & JAS_STREAM_RDBUF));

	/* Note: Do not use the quantity stream->cnt to determine the number
	of characters in the buffer!  Depending on how this function was
	called, the stream->cnt value may be "off-by-one". */
	len = stream->ptr_ - stream->bufstart_;
	if (len > 0) {
		n = (*stream->ops_->write_)(stream->obj_, (char *)
		  stream->bufstart_, len);
		if (n != len) {
			stream->flags_ |= JAS_STREAM_ERR;
			return EOF;
		}
	}
	stream->cnt_ = stream->bufsize_;
	stream->ptr_ = stream->bufstart_;

	stream->bufmode_ |= JAS_STREAM_WRBUF;

	if (c != EOF) {
		assert(stream->cnt_ > 0);
		return jas_stream_putc2(stream, c);
	}

	return 0;
}

Project: jasper
File: jas_stream.c

static void jas_stream_initbuf(jas_stream_t *stream, int bufmode, char *buf,
  int bufsize)
{
	/* If this function is being called, the buffer should not have been
	  initialized yet. */
	assert(!stream->bufbase_);

	if (bufmode != JAS_STREAM_UNBUF) {
		/* The full- or line-buffered mode is being employed. */
		if (!buf) {
			/* The caller has not specified a buffer to employ, so allocate
			  one. */
			if ((stream->bufbase_ = jas_malloc(JAS_STREAM_BUFSIZE +
			  JAS_STREAM_MAXPUTBACK))) {
				stream->bufmode_ |= JAS_STREAM_FREEBUF;
				stream->bufsize_ = JAS_STREAM_BUFSIZE;
			} else {
				/* The buffer allocation has failed.  Resort to unbuffered
				  operation. */
				stream->bufbase_ = stream->tinybuf_;
				stream->bufsize_ = 1;
			}
		} else {
			/* The caller has specified a buffer to employ. */
			/* The buffer must be large enough to accommodate maximum
			  putback. */
			assert(bufsize > JAS_STREAM_MAXPUTBACK);
			stream->bufbase_ = JAS_CAST(uchar *, buf);
			stream->bufsize_ = bufsize - JAS_STREAM_MAXPUTBACK;
		}
	} else {
		/* The unbuffered mode is being employed. */
		/* A buffer should not have been supplied by the caller. */
		assert(!buf);
		/* Use a trivial one-character buffer. */
		stream->bufbase_ = stream->tinybuf_;
		stream->bufsize_ = 1;
	}
	stream->bufstart_ = &stream->bufbase_[JAS_STREAM_MAXPUTBACK];
	stream->ptr_ = stream->bufstart_;
	stream->cnt_ = 0;
	stream->bufmode_ |= bufmode & JAS_STREAM_BUFMODEMASK;
}

Project: jasper
File: jas_stream.c

static int mem_read(jas_stream_obj_t *obj, char *buf, int cnt)
{
	int n;
	jas_stream_memobj_t *m = (jas_stream_memobj_t *)obj;
	n = m->len_ - m->pos_;
	cnt = JAS_MIN(n, cnt);
	memcpy(buf, &m->buf_[m->pos_], cnt);
	m->pos_ += cnt;
	return cnt;
}

Project: jasper
File: jas_stream.c

int jas_stream_flush(jas_stream_t *stream)
{
	if (stream->bufmode_ & JAS_STREAM_RDBUF) {
		return 0;
	}
	return jas_stream_flushbuf(stream, EOF);
}