CVE-2016-9389 (published 2017-03-23T18:59Z)

The jpc_irct and jpc_iict functions in jpc_mct.c in JasPer before 1.900.14 allow remote attackers to cause a denial of service (assertion failure).

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/mdadams/jasper
commit_details: repo_url: https://github.com/mdadams/jasper
author: Michael Adams
author_date: 2016-10-24 07:26:40-07:00
msg: The component domains must be the same for the ICT/RCT in the JPC codec.
This was previously enforced with an assertion.
Now, it is handled in a more graceful manner.
repository: repo_url: https://github.com/mdadams/jasper
repo_name: jasper-software/jasper
description: Official Repository for the JasPer Image Coding Toolkit
repo_language: C
owner: mdadams
file_changes: filename: jas_image.c
change_type: ModificationType.MODIFY
diff: @@ -77,6 +77,7 @@
 #include <assert.h>
 #include <ctype.h>
 #include <inttypes.h>
+#include <stdbool.h>
 
 #include "jasper/jas_math.h"
 #include "jasper/jas_image.h"
@@ -655,6 +656,24 @@ int jas_image_fmtfromname(char *name)
 * Miscellaneous operations.
 \******************************************************************************/
 
+bool jas_image_cmpt_domains_same(jas_image_t *image)
+{
+	int cmptno;
+	jas_image_cmpt_t *cmpt;
+	jas_image_cmpt_t *cmpt0;
+
+	cmpt0 = image->cmpts_[0];
+	for (cmptno = 1; cmptno < image->numcmpts_; ++cmptno) {
+		cmpt = image->cmpts_[cmptno];
+		if (cmpt->tlx_ != cmpt0->tlx_ || cmpt->tly_ != cmpt0->tly_ ||
+		  cmpt->hstep_ != cmpt0->hstep_ || cmpt->vstep_ != cmpt0->vstep_ ||
+		  cmpt->width_ != cmpt0->width_ || cmpt->height_ != cmpt0->height_) {
+			return 0;
+		}
+	}
+	return 1;
+}
+
 uint_fast32_t jas_image_rawsize(jas_image_t *image)
 {
 	uint_fast32_t rawsize;

programming_language: C++
filename: jas_image.h
change_type: ModificationType.MODIFY
diff: @@ -79,6 +79,7 @@
 #include <jasper/jas_seq.h>
 #include <jasper/jas_cm.h>
 #include <stdio.h>
+#include <stdbool.h>
 
 #ifdef __cplusplus
 extern "C" {
@@ -399,6 +400,9 @@ void jas_image_destroy(jas_image_t *image);
 	((image)->cmpts_[cmptno]->tly_ + (image)->cmpts_[cmptno]->height_ * \
 	  (image)->cmpts_[cmptno]->vstep_)
 
+// Test if all components are specified at the same positions in space. */
+bool jas_image_cmpt_domains_same(jas_image_t *image);
+
 /* Get the raw size of an image (i.e., the nominal size of the image without
   any compression. */
 uint_fast32_t jas_image_rawsize(jas_image_t *image);

programming_language: C++
filename: jpc_dec.c
change_type: ModificationType.MODIFY
diff: @@ -1091,6 +1091,10 @@ static int jpc_dec_tiledecode(jpc_dec_t *dec, jpc_dec_tile_t *tile)
 			jas_eprintf("RCT requires at least three components\n");
 			return -1;
 		}
+		if (!jas_image_cmpt_domains_same(dec->image)) {
+			jas_eprintf("RCT requires all components have the same domain\n");
+			return -1;
+		}
 		jpc_irct(tile->tcomps[0].data, tile->tcomps[1].data,
 		  tile->tcomps[2].data);
 		break;
@@ -1099,6 +1103,10 @@ static int jpc_dec_tiledecode(jpc_dec_t *dec, jpc_dec_tile_t *tile)
 			jas_eprintf("ICT requires at least three components\n");
 			return -1;
 		}
+		if (!jas_image_cmpt_domains_same(dec->image)) {
+			jas_eprintf("RCT requires all components have the same domain\n");
+			return -1;
+		}
 		jpc_iict(tile->tcomps[0].data, tile->tcomps[1].data,
 		  tile->tcomps[2].data);
 		break;

programming_language: C