CVE-2021-26926 (published 2021-02-23T18:15Z)

A flaw was found in jasper before 2.0.25. An out of bounds read issue was found in jp2_decode function whic may lead to disclosure of information or program crash.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/jasper-software/jasper
commit_details: repo_url: https://github.com/jasper-software/jasper
author: Michael Adams
author_date: 2021-02-07 12:31:55-08:00
msg: Fixes #264.

The JP2 decoder was allowing the decoding of a code stream to be
attempted when the stream has inconsistent values for the number of
components and/or the component types.  For such invalid streams,
only a warning would be issued and decoding would proceed.  This is
dangerous, however, as it can lead to many unexpected paths through
the code, which in some cases have been demonstrated to result in
security vulnerabilities.  This code change makes decoding of these
types invalid code streams a hard error.
repository: repo_url: https://github.com/jasper-software/jasper
repo_name: jasper-software/jasper
description: Official Repository for the JasPer Image Coding Toolkit
repo_language: C
owner: jasper-software
file_changes: filename: jp2_dec.c
change_type: ModificationType.MODIFY
diff: @@ -232,7 +232,8 @@ jas_image_t *jp2_decode(jas_stream_t *in, const char *optstr)
 	  the value specified in the code stream? */
 	if (dec->ihdr->data.ihdr.numcmpts != JAS_CAST(jas_uint,
 	  jas_image_numcmpts(dec->image))) {
-		jas_eprintf("warning: number of components mismatch\n");
+		jas_eprintf("error: number of components mismatch (IHDR)\n");
+		goto error;
 	}
 
 	/* At least one component must be present. */
@@ -255,7 +256,8 @@ jas_image_t *jp2_decode(jas_stream_t *in, const char *optstr)
 	  with the data in the code stream? */
 	if ((samedtype && dec->ihdr->data.ihdr.bpc != JP2_DTYPETOBPC(dtype)) ||
 	  (!samedtype && dec->ihdr->data.ihdr.bpc != JP2_IHDR_BPCNULL)) {
-		jas_eprintf("warning: component data type mismatch (IHDR)\n");
+		jas_eprintf("error: component data type mismatch (IHDR)\n");
+		goto error;
 	}
 
 	/* Is the compression type supported? */
@@ -267,9 +269,10 @@ jas_image_t *jp2_decode(jas_stream_t *in, const char *optstr)
 	if (dec->bpcc) {
 		/* Is the number of components indicated in the BPCC box
 		  consistent with the code stream data? */
-		if (dec->bpcc->data.bpcc.numcmpts != JAS_CAST(jas_uint, jas_image_numcmpts(
-		  dec->image))) {
-			jas_eprintf("warning: number of components mismatch\n");
+		if (dec->bpcc->data.bpcc.numcmpts !=
+		  JAS_CAST(jas_uint, jas_image_numcmpts(dec->image))) {
+			jas_eprintf("error: number of components mismatch (BPCC)\n");
+			goto error;
 		}
 		/* Is the component data type information indicated in the BPCC
 		  box consistent with the code stream data? */
@@ -278,7 +281,8 @@ jas_image_t *jp2_decode(jas_stream_t *in, const char *optstr)
 			  ++i) {
 				if (jas_image_cmptdtype(dec->image, i) !=
 				  JP2_BPCTODTYPE(dec->bpcc->data.bpcc.bpcs[i])) {
-					jas_eprintf("warning: component data type mismatch (BPCC)\n");
+					jas_eprintf("error: component data type mismatch (BPCC)\n");
+						goto error;
 				}
 			}
 		} else {

programming_language: C