CVE-2016-8884 (published 2017-03-28T14:59Z)

The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8690.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/mdadams/jasper
commit_details: repo_url: https://github.com/mdadams/jasper
author: Michael Adams
author_date: 2016-10-19 20:13:06-07:00
msg: Fixed a problem with a null pointer dereference in the BMP decoder.
repository: repo_url: https://github.com/mdadams/jasper
repo_name: jasper-software/jasper
description: Official Repository for the JasPer Image Coding Toolkit
repo_language: C
owner: mdadams
file_changes: filename: jas_seq.c
change_type: ModificationType.MODIFY
diff: @@ -102,6 +102,10 @@ jas_matrix_t *jas_matrix_create(int numrows, int numcols)
 	jas_matrix_t *matrix;
 	int i;
 
+	if (numrows < 0 || numcols < 0) {
+		return 0;
+	}
+
 	if (!(matrix = jas_malloc(sizeof(jas_matrix_t)))) {
 		return 0;
 	}

programming_language: C++
filename: bmp_dec.c
change_type: ModificationType.MODIFY
diff: @@ -107,6 +107,9 @@ jas_image_t *bmp_decode(jas_stream_t *in, char *optstr)
 	uint_fast16_t numcmpts;
 	long n;
 
+	image = 0;
+	info = 0;
+
 	if (optstr) {
 		jas_eprintf("warning: ignoring BMP decoder options\n");
 	}
@@ -121,7 +124,8 @@ jas_image_t *bmp_decode(jas_stream_t *in, char *optstr)
 	/* Read the bitmap header. */
 	if (bmp_gethdr(in, &hdr)) {
 		jas_eprintf("cannot get header\n");
-		return 0;
+		goto error;
+		//return 0;
 	}
 	JAS_DBGLOG(1, (
 	  "BMP header: magic 0x%x; siz %d; res1 %d; res2 %d; off %d\n",
@@ -131,33 +135,46 @@ jas_image_t *bmp_decode(jas_stream_t *in, char *optstr)
 	/* Read the bitmap information. */
 	if (!(info = bmp_getinfo(in))) {
 		jas_eprintf("cannot get info\n");
-		return 0;
+		//return 0;
+		goto error;
 	}
 	JAS_DBGLOG(1,
-	  ("BMP information: len %d; width %d; height %d; numplanes %d; "
-	  "depth %d; enctype %d; siz %d; hres %d; vres %d; numcolors %d; "
-	  "mincolors %d\n", info->len, info->width, info->height, info->numplanes,
-	  info->depth, info->enctype, info->siz, info->hres, info->vres,
-	  info->numcolors, info->mincolors));
+	  ("BMP information: len %ld; width %ld; height %ld; numplanes %d; "
+	  "depth %d; enctype %ld; siz %ld; hres %ld; vres %ld; numcolors %ld; "
+	  "mincolors %ld\n", JAS_CAST(long, info->len),
+	  JAS_CAST(long, info->width), JAS_CAST(long, info->height),
+	  JAS_CAST(long, info->numplanes), JAS_CAST(long, info->depth),
+	  JAS_CAST(long, info->enctype), JAS_CAST(long, info->siz),
+	  JAS_CAST(long, info->hres), JAS_CAST(long, info->vres),
+	  JAS_CAST(long, info->numcolors), JAS_CAST(long, info->mincolors)));
+
+	if (info->width < 0 || info->height < 0 || info->numplanes < 0 ||
+	  info->depth < 0 || info->siz < 0 || info->hres < 0 || info->vres < 0) {
+		jas_eprintf("corrupt bit stream\n");
+		goto error;
+	}
 
 	/* Ensure that we support this type of BMP file. */
 	if (!bmp_issupported(&hdr, info)) {
 		jas_eprintf("error: unsupported BMP encoding\n");
-		bmp_info_destroy(info);
-		return 0;
+		//bmp_info_destroy(info);
+		//return 0;
+		goto error;
 	}
 
 	/* Skip over any useless data between the end of the palette
 	  and start of the bitmap data. */
 	if ((n = hdr.off - (BMP_HDRLEN + BMP_INFOLEN + BMP_PALLEN(info))) < 0) {
 		jas_eprintf("error: possibly bad bitmap offset?\n");
-		return 0;
+		goto error;
+		//return 0;
 	}
 	if (n > 0) {
 		jas_eprintf("skipping unknown data in BMP file\n");
 		if (bmp_gobble(in, n)) {
-			bmp_info_destroy(info);
-			return 0;
+			//bmp_info_destroy(info);
+			//return 0;
+			goto error;
 		}
 	}
 
@@ -179,8 +196,9 @@ jas_image_t *bmp_decode(jas_stream_t *in, char *optstr)
 	/* Create image object. */
 	if (!(image = jas_image_create(numcmpts, cmptparms,
 	  JAS_CLRSPC_UNKNOWN))) {
-		bmp_info_destroy(info);
-		return 0;
+		//bmp_info_destroy(info);
+		//return 0;
+		goto error;
 	}
 
 	if (numcmpts == 3) {
@@ -199,14 +217,24 @@ jas_image_t *bmp_decode(jas_stream_t *in, char *optstr)
 
 	/* Read the bitmap data. */
 	if (bmp_getdata(in, info, image)) {
-		bmp_info_destroy(info);
-		jas_image_destroy(image);
-		return 0;
+		//bmp_info_destroy(info);
+		//jas_image_destroy(image);
+		//return 0;
+		goto error;
 	}
 
 	bmp_info_destroy(info);
 
 	return image;
+
+error:
+	if (info) {
+		bmp_info_destroy(info);
+	}
+	if (image) {
+		jas_image_destroy(image);
+	}
+	return 0;
 }
 
 int bmp_validate(jas_stream_t *in)

programming_language: C++