Vulnerability: A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c) or possibly remote code execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14152.
Vulnerability ID: CVE-2017-14164
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/uclouvain/openjpeg
Published: 2017-09-06
File: src/lib/openjp2/j2k.c
Commit message: opj_j2k_write_sot(): fix potential write heap buffer overflow (#991)
Commit author: Even Rouault

Vulnerable version (before fix):
 static OPJ_BOOL opj_j2k_write_tlm(opj_j2k_t *p_j2k,  * Writes the SOT marker (Start of tile-part)  *  * @param       p_j2k            J2K codec.  * @param       p_data           FIXME DOC  * @param       p_data_written   FIXME DOC  * @param       p_stream         the stream to write data to.  * @param       p_manager        the user event manager. */ static OPJ_BOOL opj_j2k_write_sot(opj_j2k_t *p_j2k,                                   OPJ_BYTE * p_data,                                   OPJ_UINT32 * p_data_written,                                   const opj_stream_private_t *p_stream,                                   opj_event_mgr_t * p_manager); static OPJ_BOOL opj_j2k_write_tlm(opj_j2k_t *p_j2k,  static OPJ_BOOL opj_j2k_write_sot(opj_j2k_t *p_j2k,                                   OPJ_BYTE * p_data,                                   OPJ_UINT32 * p_data_written,                                   const opj_stream_private_t *p_stream,                                   opj_event_mgr_t * p_manager static OPJ_BOOL opj_j2k_write_sot(opj_j2k_t *p_j2k,     OPJ_UNUSED(p_stream);     OPJ_UNUSED(p_manager);      opj_write_bytes(p_data, J2K_MS_SOT,                     2);                                 /* SOT */     p_data += 2; static OPJ_BOOL opj_j2k_write_first_tile_part(opj_j2k_t *p_j2k,      l_current_nb_bytes_written = 0;     l_begin_data = p_data;     if (! opj_j2k_write_sot(p_j2k, p_data, &l_current_nb_bytes_written, p_stream,                             p_manager)) {         return OPJ_FALSE;     } static OPJ_BOOL opj_j2k_write_all_tile_parts(opj_j2k_t *p_j2k,         l_part_tile_size = 0;         l_begin_data = p_data;          if (! opj_j2k_write_sot(p_j2k, p_data, &l_current_nb_bytes_written, p_stream,                                 p_manager)) {             return OPJ_FALSE;         } static OPJ_BOOL opj_j2k_write_all_tile_parts(opj_j2k_t *p_j2k,             l_part_tile_size = 0;             l_begin_data = p_data;              if (! opj_j2k_write_sot(p_j2k, p_data, &l_current_nb_bytes_written, p_stream,                                     p_manager)) {                 return OPJ_FALSE;             }

Fixed version (after fix):
 static OPJ_BOOL opj_j2k_write_tlm(opj_j2k_t *p_j2k,  * Writes the SOT marker (Start of tile-part)  *  * @param       p_j2k            J2K codec.  * @param       p_data           Output buffer  * @param       p_total_data_size Output buffer size  * @param       p_data_written   Number of bytes written into stream  * @param       p_stream         the stream to write data to.  * @param       p_manager        the user event manager. */ static OPJ_BOOL opj_j2k_write_sot(opj_j2k_t *p_j2k,                                   OPJ_BYTE * p_data,                                   OPJ_UINT32 p_total_data_size,                                   OPJ_UINT32 * p_data_written,                                   const opj_stream_private_t *p_stream,                                   opj_event_mgr_t * p_manager); static OPJ_BOOL opj_j2k_write_tlm(opj_j2k_t *p_j2k,  static OPJ_BOOL opj_j2k_write_sot(opj_j2k_t *p_j2k,                                   OPJ_BYTE * p_data,                                   OPJ_UINT32 p_total_data_size,                                   OPJ_UINT32 * p_data_written,                                   const opj_stream_private_t *p_stream,                                   opj_event_mgr_t * p_manager static OPJ_BOOL opj_j2k_write_sot(opj_j2k_t *p_j2k,     OPJ_UNUSED(p_stream);     OPJ_UNUSED(p_manager);      if (p_total_data_size < 12) {         opj_event_msg(p_manager, EVT_ERROR,                       "Not enough bytes in output buffer to write SOT marker\n");         return OPJ_FALSE;     }      opj_write_bytes(p_data, J2K_MS_SOT,                     2);                                 /* SOT */     p_data += 2; static OPJ_BOOL opj_j2k_write_first_tile_part(opj_j2k_t *p_j2k,      l_current_nb_bytes_written = 0;     l_begin_data = p_data;     if (! opj_j2k_write_sot(p_j2k, p_data, p_total_data_size,                             &l_current_nb_bytes_written, p_stream,                             p_manager)) {         return OPJ_FALSE;     } static OPJ_BOOL opj_j2k_write_all_tile_parts(opj_j2k_t *p_j2k,         l_part_tile_size = 0;         l_begin_data = p_data;          if (! opj_j2k_write_sot(p_j2k, p_data,                                 p_total_data_size,                                 &l_current_nb_bytes_written,                                 p_stream,                                 p_manager)) {             return OPJ_FALSE;         } static OPJ_BOOL opj_j2k_write_all_tile_parts(opj_j2k_t *p_j2k,             l_part_tile_size = 0;             l_begin_data = p_data;              if (! opj_j2k_write_sot(p_j2k, p_data,                                     p_total_data_size,                                     &l_current_nb_bytes_written, p_stream,                                     p_manager)) {                 return OPJ_FALSE;             }

Patch:
patch: @@ -832,13 +832,15 @@ static OPJ_BOOL opj_j2k_write_tlm(opj_j2k_t *p_j2k,
  * Writes the SOT marker (Start of tile-part)
  *
  * @param       p_j2k            J2K codec.
- * @param       p_data           FIXME DOC
- * @param       p_data_written   FIXME DOC
+ * @param       p_data           Output buffer
+ * @param       p_total_data_size Output buffer size
+ * @param       p_data_written   Number of bytes written into stream
  * @param       p_stream         the stream to write data to.
  * @param       p_manager        the user event manager.
 */
 static OPJ_BOOL opj_j2k_write_sot(opj_j2k_t *p_j2k,
                                   OPJ_BYTE * p_data,
+                                  OPJ_UINT32 p_total_data_size,
                                   OPJ_UINT32 * p_data_written,
                                   const opj_stream_private_t *p_stream,
                                   opj_event_mgr_t * p_manager);
@@ -4201,6 +4203,7 @@ static OPJ_BOOL opj_j2k_write_tlm(opj_j2k_t *p_j2k,
 
 static OPJ_BOOL opj_j2k_write_sot(opj_j2k_t *p_j2k,
                                   OPJ_BYTE * p_data,
+                                  OPJ_UINT32 p_total_data_size,
                                   OPJ_UINT32 * p_data_written,
                                   const opj_stream_private_t *p_stream,
                                   opj_event_mgr_t * p_manager
@@ -4214,6 +4217,12 @@ static OPJ_BOOL opj_j2k_write_sot(opj_j2k_t *p_j2k,
     OPJ_UNUSED(p_stream);
     OPJ_UNUSED(p_manager);
 
+    if (p_total_data_size < 12) {
+        opj_event_msg(p_manager, EVT_ERROR,
+                      "Not enough bytes in output buffer to write SOT marker\n");
+        return OPJ_FALSE;
+    }
+
     opj_write_bytes(p_data, J2K_MS_SOT,
                     2);                                 /* SOT */
     p_data += 2;
@@ -11480,7 +11489,8 @@ static OPJ_BOOL opj_j2k_write_first_tile_part(opj_j2k_t *p_j2k,
 
     l_current_nb_bytes_written = 0;
     l_begin_data = p_data;
-    if (! opj_j2k_write_sot(p_j2k, p_data, &l_current_nb_bytes_written, p_stream,
+    if (! opj_j2k_write_sot(p_j2k, p_data, p_total_data_size,
+                            &l_current_nb_bytes_written, p_stream,
                             p_manager)) {
         return OPJ_FALSE;
     }
@@ -11572,7 +11582,10 @@ static OPJ_BOOL opj_j2k_write_all_tile_parts(opj_j2k_t *p_j2k,
         l_part_tile_size = 0;
         l_begin_data = p_data;
 
-        if (! opj_j2k_write_sot(p_j2k, p_data, &l_current_nb_bytes_written, p_stream,
+        if (! opj_j2k_write_sot(p_j2k, p_data,
+                                p_total_data_size,
+                                &l_current_nb_bytes_written,
+                                p_stream,
                                 p_manager)) {
             return OPJ_FALSE;
         }
@@ -11615,7 +11628,9 @@ static OPJ_BOOL opj_j2k_write_all_tile_parts(opj_j2k_t *p_j2k,
             l_part_tile_size = 0;
             l_begin_data = p_data;
 
-            if (! opj_j2k_write_sot(p_j2k, p_data, &l_current_nb_bytes_written, p_stream,
+            if (! opj_j2k_write_sot(p_j2k, p_data,
+                                    p_total_data_size,
+                                    &l_current_nb_bytes_written, p_stream,
                                     p_manager)) {
                 return OPJ_FALSE;
             }
path: src/lib/openjp2/j2k.c