CVE-2016-3183 (C, published 2017-02-03T16:59Z)
Description: value: The sycc422_t_rgb function in common/color.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted jpeg2000 file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/uclouvain/openjpeg
Files changed:
src/bin/common/color.c
src/bin/jp2/convertbmp.c
Commit message: Fix Out-Of-Bounds Read in sycc42x_to_rgb function (#745)

42x Images with an odd x0/y0 lead to subsampled component starting at the
2nd column/line.
That is offset = comp->dx * comp->x0 - image->x0 = 1

Fix #726

Vulnerable code:
	unsigned int maxw, maxh, max, i;
	maxw = (unsigned int)img->comps[0].w; maxh = (unsigned int)img->comps[0].h;
	d0 = r = (int*)malloc(sizeof(int) * (size_t)max);
	d1 = g = (int*)malloc(sizeof(int) * (size_t)max);
	d2 = b = (int*)malloc(sizeof(int) * (size_t)max);
	if(r) free(r);
	if(g) free(g);
	if(b) free(b);

	unsigned int maxw, maxh, max;
	unsigned int i, j;
	maxw = (unsigned int)img->comps[0].w; maxh = (unsigned int)img->comps[0].h;
	d0 = r = (int*)malloc(sizeof(int) * (size_t)max);
	d1 = g = (int*)malloc(sizeof(int) * (size_t)max);
	d2 = b = (int*)malloc(sizeof(int) * (size_t)max);
		for(j=0U; j < (maxw & ~(unsigned int)1U); j += 2U)
		if (j < maxw) {
#if defined(USE_JPWL) || defined(USE_MJ2)
	img->comps[1].w = maxw; img->comps[1].h = maxh;
	img->comps[2].w = maxw; img->comps[2].h = maxh;
#else
	img->comps[1].w = (OPJ_UINT32)maxw; img->comps[1].h = (OPJ_UINT32)maxh;
	img->comps[2].w = (OPJ_UINT32)maxw; img->comps[2].h = (OPJ_UINT32)maxh;
#endif
	img->comps[1].dx = img->comps[0].dx;
	img->comps[2].dx = img->comps[0].dx;
	img->comps[1].dy = img->comps[0].dy;
	img->comps[2].dy = img->comps[0].dy;
	if(r) free(r);
	if(g) free(g);
	if(b) free(b);

	unsigned int maxw, maxh, max;
	unsigned int i, j;
	maxw = (unsigned int)img->comps[0].w; maxh = (unsigned int)img->comps[0].h;
	d0 = r = (int*)malloc(sizeof(int) * (size_t)max);
	d1 = g = (int*)malloc(sizeof(int) * (size_t)max);
	d2 = b = (int*)malloc(sizeof(int) * (size_t)max);

	if(r == NULL || g == NULL || b == NULL) goto fails;
	for(i=0U; i < (maxh & ~(unsigned int)1U); i += 2U)
		for(j=0; j < (maxw & ~(unsigned int)1U); j += 2U)
		if(j < maxw)
	if(i < maxh)
		for(j=0U; j < (maxw & ~(unsigned int)1U); j += 2U)
#if defined(USE_JPWL) || defined(USE_MJ2)
	img->comps[1].w = maxw; img->comps[1].h = maxh;
	img->comps[2].w = maxw; img->comps[2].h = maxh;
#else
	img->comps[1].w = (OPJ_UINT32)maxw; img->comps[1].h = (OPJ_UINT32)maxh;
	img->comps[2].w = (OPJ_UINT32)maxw; img->comps[2].h = (OPJ_UINT32)maxh;
#endif
	img->comps[1].dx = img->comps[0].dx;
	img->comps[2].dx = img->comps[0].dx;
	img->comps[1].dy = img->comps[0].dy;
	img->comps[2].dy = img->comps[0].dy;
	if(r) free(r);
	if(g) free(g);
	if(b) free(b);

	img->color_space = OPJ_CLRSPC_SRGB;

                for ((pad = w % 4) ? (4 - w % 4) : 0; pad > 0; pad--)	/* ADD */

Fixed code:
	size_t maxw, maxh, max, i;
	maxw = (size_t)img->comps[0].w; maxh = (size_t)img->comps[0].h;
	d0 = r = (int*)malloc(sizeof(int) * max);
	d1 = g = (int*)malloc(sizeof(int) * max);
	d2 = b = (int*)malloc(sizeof(int) * max);
	img->color_space = OPJ_CLRSPC_SRGB;
	free(r);
	free(g);
	free(b);
	size_t maxw, maxh, max, offx, loopmaxw;
	size_t i;
	maxw = (size_t)img->comps[0].w; maxh = (size_t)img->comps[0].h;
	d0 = r = (int*)malloc(sizeof(int) * max);
	d1 = g = (int*)malloc(sizeof(int) * max);
	d2 = b = (int*)malloc(sizeof(int) * max);
	/* if img->x0 is odd, then first column shall use Cb/Cr = 0 */
	offx = img->x0 & 1U;
	loopmaxw = maxw - offx;
	
		size_t j;
		
		if (offx > 0U) {
			sycc_to_rgb(offset, upb, *y, 0, 0, r, g, b);
			++y; ++r; ++g; ++b;
		}
		
		for(j=0U; j < (loopmaxw & ~(size_t)1U); j += 2U)
		if (j < loopmaxw) {
	
	img->comps[1].w = img->comps[2].w = img->comps[0].w;
	img->comps[1].h = img->comps[2].h = img->comps[0].h;
	img->comps[1].dx = img->comps[2].dx = img->comps[0].dx;
	img->comps[1].dy = img->comps[2].dy = img->comps[0].dy;
	img->color_space = OPJ_CLRSPC_SRGB;
	free(r);
	free(g);
	free(b);
	size_t maxw, maxh, max, offx, loopmaxw, offy, loopmaxh;
	size_t i;
	maxw = (size_t)img->comps[0].w; maxh = (size_t)img->comps[0].h;
	d0 = r = (int*)malloc(sizeof(int) * max);
	d1 = g = (int*)malloc(sizeof(int) * max);
	d2 = b = (int*)malloc(sizeof(int) * max);
	
	if (r == NULL || g == NULL || b == NULL) goto fails;
	
	/* if img->x0 is odd, then first column shall use Cb/Cr = 0 */
	offx = img->x0 & 1U;
	loopmaxw = maxw - offx;
	/* if img->y0 is odd, then first line shall use Cb/Cr = 0 */
	offy = img->y0 & 1U;
	loopmaxh = maxh - offy;
	
	if (offy > 0U) {
		size_t j;
		
		for(j=0; j < maxw; ++j)
		{
			sycc_to_rgb(offset, upb, *y, 0, 0, r, g, b);
			++y; ++r; ++g; ++b;
		}
	}
	for(i=0U; i < (loopmaxh & ~(size_t)1U); i += 2U)
		size_t j;
		
		
		if (offx > 0U) {
			sycc_to_rgb(offset, upb, *y, 0, 0, r, g, b);
			++y; ++r; ++g; ++b;
			sycc_to_rgb(offset, upb, *ny, *cb, *cr, nr, ng, nb);
			++ny; ++nr; ++ng; ++nb;
		}
		for(j=0; j < (loopmaxw & ~(size_t)1U); j += 2U)
		if(j < loopmaxw)
	if(i < loopmaxh)
		size_t j;
		
		for(j=0U; j < (maxw & ~(size_t)1U); j += 2U)
	img->comps[1].w = img->comps[2].w = img->comps[0].w;
	img->comps[1].h = img->comps[2].h = img->comps[0].h;
	img->comps[1].dx = img->comps[2].dx = img->comps[0].dx;
	img->comps[1].dy = img->comps[2].dy = img->comps[0].dy;
	img->color_space = OPJ_CLRSPC_SRGB;
	free(r);
	free(g);
	free(b);
                for (pad = (w % 4) ? (4 - w % 4) : 0; pad > 0; pad--)	/* ADD */