CVE-2016-8690 (published 2017-02-15T19:59Z)

The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted BMP image in an imginfo command.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/mdadams/jasper
commit_details: repo_url: https://github.com/mdadams/jasper
author: Michael Adams
author_date: 2016-10-15 20:32:23-07:00
msg: Fixed a sanitizer failure in the BMP codec.
Also, added a --debug-level command line option to the imginfo command
for debugging purposes.
repository: repo_url: https://github.com/mdadams/jasper
repo_name: jasper-software/jasper
description: Official Repository for the JasPer Image Coding Toolkit
repo_language: C
owner: mdadams
file_changes: filename: imginfo.c
change_type: ModificationType.MODIFY
diff: @@ -85,7 +85,8 @@ typedef enum {
 	OPT_HELP,
 	OPT_VERSION,
 	OPT_VERBOSE,
-	OPT_INFILE
+	OPT_INFILE,
+	OPT_DEBUG
 } optid_t;
 
 /******************************************************************************\
@@ -104,6 +105,7 @@ static jas_opt_t opts[] = {
 	{OPT_VERSION, "version", 0},
 	{OPT_VERBOSE, "verbose", 0},
 	{OPT_INFILE, "f", JAS_OPT_HASARG},
+	{OPT_DEBUG, "debug-level", JAS_OPT_HASARG},
 	{-1, 0, 0}
 };
 
@@ -126,6 +128,7 @@ int main(int argc, char **argv)
 	int numcmpts;
 	int verbose;
 	char *fmtname;
+	int debug;
 
 	if (jas_init()) {
 		abort();
@@ -135,6 +138,7 @@ int main(int argc, char **argv)
 
 	infile = 0;
 	verbose = 0;
+	debug = 0;
 
 	/* Parse the command line options. */
 	while ((id = jas_getopt(argc, argv, opts)) >= 0) {
@@ -146,6 +150,9 @@ int main(int argc, char **argv)
 			printf("%s\n", JAS_VERSION);
 			exit(EXIT_SUCCESS);
 			break;
+		case OPT_DEBUG:
+			debug = atoi(jas_optarg);
+			break;
 		case OPT_INFILE:
 			infile = jas_optarg;
 			break;
@@ -156,6 +163,8 @@ int main(int argc, char **argv)
 		}
 	}
 
+	jas_setdbglevel(debug);
+
 	/* Open the image file. */
 	if (infile) {
 		/* The image is to be read from a file. */
@@ -177,6 +186,7 @@ int main(int argc, char **argv)
 
 	/* Decode the image. */
 	if (!(image = jas_image_decode(instream, fmtid, 0))) {
+		jas_stream_close(instream);
 		fprintf(stderr, "cannot load image\n");
 		return EXIT_FAILURE;
 	}

programming_language: C
filename: bmp_dec.c
change_type: ModificationType.MODIFY
diff: @@ -77,6 +77,7 @@
 #include "jasper/jas_stream.h"
 #include "jasper/jas_image.h"
 #include "jasper/jas_malloc.h"
+#include "jasper/jas_debug.h"
 
 #include "bmp_cod.h"
 
@@ -122,12 +123,22 @@ jas_image_t *bmp_decode(jas_stream_t *in, char *optstr)
 		jas_eprintf("cannot get header\n");
 		return 0;
 	}
+	JAS_DBGLOG(1, (
+	  "BMP header: magic 0x%x; siz %d; res1 %d; res2 %d; off %d\n",
+	  hdr.magic, hdr.siz, hdr.reserved1, hdr.reserved2, hdr.off
+	  ));
 
 	/* Read the bitmap information. */
 	if (!(info = bmp_getinfo(in))) {
 		jas_eprintf("cannot get info\n");
 		return 0;
 	}
+	JAS_DBGLOG(1,
+	  ("BMP information: len %d; width %d; height %d; numplanes %d; "
+	  "depth %d; enctype %d; siz %d; hres %d; vres %d; numcolors %d; "
+	  "mincolors %d\n", info->len, info->width, info->height, info->numplanes,
+	  info->depth, info->enctype, info->siz, info->hres, info->vres,
+	  info->numcolors, info->mincolors));
 
 	/* Ensure that we support this type of BMP file. */
 	if (!bmp_issupported(&hdr, info)) {
@@ -440,7 +451,7 @@ static int bmp_getint32(jas_stream_t *in, int_fast32_t *val)
 		if ((c = jas_stream_getc(in)) == EOF) {
 			return -1;
 		}
-		v |= (c << 24);
+		v |= (JAS_CAST(uint_fast32_t, c) << 24);
 		if (--n <= 0) {
 			break;
 		}

programming_language: C