Penetration Test Report (X41 D-Sec): X41 OSTIF libjpegturbo Audit 20230712 Public

SourceCodeAuditonlibjpeg-turbo
forOpenSourceTechnologyImprovementFund(OSTIF)
FinalReportandManagementSummary
2023-07-12PUBLIC
X41 D-SEC GmbH
Krefelder Str. 123
D-52070 Aachen
Amtsgericht Aachen: HRB19989
https://x41-dsec.de/
info@x41-dsec.de
OrganizedbytheOpenSourceTechnologyImprovementFund
SourceCodeAuditonlibjpeg-turbo
Revision Date Change Author(s)
1 2023-06-20 FinalReportandManagement MSc. H.Moesl,Dipl.-Ing. D.Gstir,
Summary R.WeinbergerandD.Oberhollen-
zer
X41D-SecGmbH PUBLIC Page1of51
SourceCodeAuditonlibjpeg-turbo forOpenSourceTechnologyImprovementFund(OSTIF)
Contents
1 ExecutiveSummary 4
2 Introduction 7
2.1 FindingsOverview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.2 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.3 Coverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.4 RecommendedFurtherTests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3 RatingMethodologyforSecurityVulnerabilities 12
3.1 CommonWeaknessEnumeration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
4 Results 14
4.1 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
4.2 InformationalNotes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
5 AboutX41D-SecGmbH 23
A Appendix 25
A.1 FuzzingHarnesses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
X41D-SecGmbH PUBLIC Page2of51
SourceCodeAuditonlibjpeg-turbo
Dashboard
Target
Customer OpenSourceTechnologyImprovementFund(OSTIF)
Name libjpeg-turbo
Type SourceCode
Version Asdeployedbetween2023-04-17and2023-05-30
Engagement
Type SourceCodeAudit
4: MSc. H.Moesl,Dipl.-Ing. D.Gstir,R.WeinbergerandD.
Consultants
Oberhollenzer
EngagementEffort 25person-days,2023-04-17to2023-05-30
Totalissuesfound 2
Critical - 0
High - 0
Medium - 0 CWE-125(1) CWE-787(1)
Low - 2
None - 1
0 0.2 0.4 0.6 0.8 1 1.2 1.4 1.6 1.8 2
Figure1:IssueOverview(l:Severity,r:CWEDistribution)
X41D-SecGmbH PUBLIC Page3of51
SourceCodeAuditonlibjpeg-turbo forOpenSourceTechnologyImprovementFund(OSTIF)
1 Executive Summary
InMay2023,X41D-SecGmbHperformedaSourceCodeAuditagainstlibjpeg-turbotoidentify
vulnerabilitiesandweaknessesinthesourcecode. ThetestwasorganizedbytheOpenSource
TechnologyImprovementFund(OSTIF)1.
AtotaloftwovulnerabilitieswerediscoveredduringthetestbyX41.Nonewereratedascritical,
nonewereclassifiedashighseverity, noneasmedium, andtwoaslow. Additionally, oneissue
withoutadirectsecurityimpactwasidentified.
Low - 2
Figure1.1:IssuesandSeverity
libjpeg-turboisaJPEGimagedecodingsoftwarethatusesSIMDinstructionstoacceleratebase-
lineJPEGcompressionanddecompressionforvariousplatforms,includingx86andARM.
As it is common for compiled languages, a particular focus was placed on the identification of
typical memory corruption vulnerabilities such as buffer overflows, information leakages, use-
1https://ostif.org
X41D-SecGmbH PUBLIC Page4of51
SourceCodeAuditonlibjpeg-turbo
after-frees. Moreover, the testing team dedicated substantial focus and effort into examining
the input validation associated with the various API calls, conducting variant analysis on pre-
vious bugs classified as security vulnerabilities, and generally reviewing memory management
practices.
Inasourcecodeaudit,thetestersreceiveallavailableinformationaboutthetarget.Thetestwas
performedbyfourexperiencedsecurityexpertsbetween2023-04-17and2023-05-30.
As we conclude the audit process for the libjpeg-turbo library, it’s important to highlight the
excellentconditionthislibraryisin.Afterrigorousexaminationbymultipleauditors,allreviewing
thelibraryindependently,itisremarkabletonotethatveryfewareasofconcernwereidentified.
Thissignifiesthestrongrobustnessofthecode, itsquality, anditsadherencetobestpractices
withregardtosecureprogrammingprinciples.
Thisauditwasconductedusingdifferenttestingtechniquesandapproaches,ensuringbroadtest-
ing coverage. In terms of dynamic testing, the team developed several fuzz testing harnesses.
Fuzztestingis,ingeneral,essentialfortheoverallsecurityofthelibjpeg-turboproject,especially
sinceitisimplementedinC,whichisoftenpronetomemorycorruptionvulnerabilities. Forthe
purposeofthistest,codecoveragedrivenfuzztestingusingAFL++incombinationwithaddress
spacesanitizers(suchasASAN)wasperformed.Itishighlyrecommendedtoincorporatethede-
velopedharnessesintothelibjpeg-turboprojectandtomaintainthehighstandardsandensure
thatfuzzingremainsanintegralandfixedpartoflibjpeg-turbo,eitherusingAFL++orlibFuzzer,
resultinginbettertestingcoverage.
Furthermore,bothmanualandtool-drivenstaticsourcecodeanalyseswasperformed. Thefor-
mer allowed the team to have a thorough and detailed understanding of the code, where the
public facing API interface was under scrutiny concerning memory corruption flaws as well as
secure coding standards in general. The manual auditing process was assisted by the usage of
state-of-the-arttoolsCodeQL,whichallowsforadvancedsemanticcodeanalysisincludingtaint
trackinganddataflowanalysis,addinganextralayerofcomprehensiontothisaudit.
Intotal,X41wasabletoidentifythreeissuesthroughfuzztesting:
1. tj3Decompress:Out-of-boundsreadin2:1upsamplingcode
2. tj3Transform:Memorycorruption
3. tj3Transform:Out-of-boundswrite
Again,itmustbereiteratedthatthisassessmentprovidedvaluableinsightsintothesecuritypos-
tureatthetimeoftesting,butitisimportanttonotethatanycodeauditisunabletoguarantee
thatthesoftwarecomplexisfreeofadditionalbugs.
Tosumup,theresultsofthisauditspeakvolumesaboutthesoundnessofthelibjpeg-turbolibrary.
X41D-SecGmbH PUBLIC Page5of51
SourceCodeAuditonlibjpeg-turbo
It deserves high praise to find a library that stands up so well under such rigorous and diverse
testingapproaches. Thecombinationofmanualandautomatedtestingmethods,inconjunction
withtheuseoftoolslikeCodeQL,hasensuredalevelofscrutinythatleavesX41confidentinthe
resilience and reliability of libjpeg-turbo library. Nevertheless, due to the widespread usage of
libjpeg-turbo,itisencouragedtoperformrecurringsecurityaudits,becausenewvulnerabilities
maybeintroducedasmorefeaturesareaddedandalsochangeswithinonepartofthesystem
mayhaveunintentionalsecurityimpacttootherparts.
X41D-SecGmbH PUBLIC Page6of51
SourceCodeAuditonlibjpeg-turbo forOpenSourceTechnologyImprovementFund(OSTIF)
2 Introduction
The assessment comprised a security review of the libjpeg-turbo library, utilizing static source
code analysis as well as dynamic testing using dedicated fuzz testing harnesses. The branch in
scopeforthisinspectionwasthemainbranchwiththecommitid:
• 3a[PII_REDACTED]3013dcec61a90f0e9ed302ea5156
Themainobjectiveofthissecurityassessmentwastheidentificationofvulnerabilitieswithinthe
libjpeg-turbocodebase.Itmustbenotedthatnocommunicationchannelwiththemaintainerof
thelibjpeg-turbowasavailable. Therefore,thetestingteamwasunabletodefinespecificareas
ofinterestupfront.
Fromaprogrammingstyleandsoftwaredesignperspectivethecodeanddesigniscleanandvery
wellwritten,withsecurityinmind.
X41D-SecGmbH PUBLIC Page7of51
SourceCodeAuditonlibjpeg-turbo
2.1 Findings Overview
DESCRIPTION SEVERITY ID REF
Out of Bounds Write in tj3Transform() for Non-Resizeable, LOW LJPGT-PT-23-01 4.1.1
Pre-AllocatedBuffers
Out-of-boundsReadin2:1UpsamplingCode LOW LJPGT-PT-23-02 4.1.2
MemoryCorruptionintj3Transform() NONE LJPGT-PT-23-100 4.2.1
Table2.1:Security-RelevantFindings
2.2 Scope
Duetotheabsenceofspecificallyoutlinedfocusareas,theevaluationcenteredaroundabroad
inspection,primarilylookingforcommonmemorycorruptionvulnerabilities.
2.3 Coverage
Asecurityassessmentattemptstofindthemostimportantorsometimesasmanyoftheexisting
problemsaspossible,thoughitispracticallyneverpossibletoruleoutthepossibilityofadditional
weaknessesbeingfoundinthefuture.
A manual approach for code review is used by X41. This process was combined with fuzzing
giventhenatureoflibjpeg-turbobeingexposedtoparsingofpotentiallyuntrustworthydata.
ThetimeallocatedtoX41forthiscoderevie