CVE-2022-31796 (published 2022-06-02T14:15Z)

libjpeg 1.63 has a heap-based buffer over-read in HierarchicalBitmapRequester::FetchRegion in hierarchicalbitmaprequester.cpp because the MCU size can be different between allocation and use.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/thorfdbg/libjpeg
commit_details: repo_url: https://github.com/thorfdbg/libjpeg
author: Thomas Richter
author_date: 2022-05-24 07:44:38+02:00
msg: The code now checks for consistency of the MCU sizes across
hierarchical levels, and fails in case they are different.
repository: repo_url: https://github.com/thorfdbg/libjpeg
repo_name: thorfdbg/libjpeg
description: A complete implementation of 10918-1 (JPEG) coming from jpeg.org (the ISO group) with extensions for HDR, lossless and alpha channel coding standardized as ISO/IEC 18477 (JPEG XT).
repo_language: C++
owner: thorfdbg
file_changes: filename: README
change_type: ModificationType.MODIFY
diff: @@ -460,6 +460,8 @@ out-of-bounds symbol triggered and out-of-bounds array access and could
 have crashed the decoder. The code is now more carefully changing the
 validity of the symbols and aborts with an error if it finds illegal
 codes.
+The code now also checks the consistency of the MCU sizes in the
+hierarchical process and fails if they differ across levels.
 
 --------------------------------------------------------------------------
 

programming_language: Markdown
filename: README.history
change_type: ModificationType.MODIFY
diff: @@ -564,5 +564,7 @@ out-of-bounds symbol triggered and out-of-bounds array access and could
 have crashed the decoder. The code is now more carefully changing the
 validity of the symbols and aborts with an error if it finds illegal
 codes.
+The code now also checks the consistency of the MCU sizes in the
+hierarchical process and fails if they differ across levels.
 
 --------------------------------------------------------------------------

programming_language: Markdown
filename: hierarchicalbitmaprequester.cpp
change_type: ModificationType.MODIFY
diff: @@ -45,7 +45,7 @@
 ** decoding. It also keeps the top-level color transformer and the
 ** toplevel subsampling expander.
 **
-** $Id: hierarchicalbitmaprequester.cpp,v 1.42 2020/04/08 10:05:41 thor Exp $
+** $Id: hierarchicalbitmaprequester.cpp,v 1.43 2022/05/24 05:42:35 thor Exp $
 **
 */
 
@@ -245,6 +245,16 @@ void HierarchicalBitmapRequester::PrepareForDecoding(void)
       UBYTE sx = comp->SubXOf();
       UBYTE sy = comp->SubYOf();
 
+      if (m_pLargestScale) {
+        class Frame *frame = m_pLargestScale->FrameOf();
+        while(frame) {
+          if (frame->ComponentOf(i)->SubXOf() != sx || frame->ComponentOf(i)->SubYOf() != sy)
+            JPG_THROW(MALFORMED_STREAM,"HierarchicalBitmapRequester::PrepareForDecoding",
+                      "component subsampling is inconsistent across hierarchical levels");
+          frame = frame->NextOf();
+        }
+      }
+
       if (sx > 1 || sy > 1) {
         m_ppUpsampler[i] = UpsamplerBase::CreateUpsampler(m_pEnviron,sx,sy,
                                                           m_ulPixelWidth,m_ulPixelHeight,

programming_language: C++