Description:
jasper is an open-source initiative to provide a free software-based reference implementation of the codec specified in the JPEG-2000 Part-1 standard.
Another round of fuzzing shows that a crafted image causes a read overflow.
The complete ASan output:
# imginfo -f $FILE warning: ignoring unknown marker segment (0xff70) type = 0xff70 (UNKNOWN); len = 35;00 01 43 72 65 61 74 6f 74 3a 30 4a 61 73 50 65 72 00 01 00 00 73 69 6f 6e 20 31 2e 39 30 30 2e 39 warning: trailing garbage in marker segment (3 bytes) warning: trailing garbage in marker segment (8 bytes) warning: trailing garbage in marker segment (6 bytes) ================================================================= ==30315==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61a00001f808 at pc 0x7fb7b2667e54 bp 0x7ffd0a9ab890 sp 0x7ffd0a9ab888 READ of size 8 at 0x61a00001f808 thread T0 #0 0x7fb7b2667e53 in jpc_dec_decodepkt /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_t2dec.c:245:14 #1 0x7fb7b2667e53 in jpc_dec_decodepkts /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_t2dec.c:454 #2 0x7fb7b25ccd37 in jpc_dec_process_sod /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:628:6 #3 0x7fb7b25d6853 in jpc_dec_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:425:10 #4 0x7fb7b25d6853 in jpc_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:262 #5 0x7fb7b25a6231 in jp2_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jp2/jp2_dec.c:218:21 #6 0x7fb7b2568214 in jas_image_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/base/jas_image.c:444:16 #7 0x50a3be in main /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/appl/imginfo.c:238:16 #8 0x7fb7b164878f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289 #9 0x419cd8 in _start (/usr/bin/imginfo+0x419cd8) 0x61a00001f808 is located 48 bytes to the right of 1368-byte region [0x61a00001f280,0x61a00001f7d8) allocated by thread T0 here: #0 0x4d2a98 in malloc /tmp/portage/sys-devel/llvm-3.9.1/work/llvm-3.9.1.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64 #1 0x7fb7b2575160 in jas_malloc /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/base/jas_malloc.c:242:11 #2 0x7fb7b2575160 in jas_alloc2 /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/base/jas_malloc.c:275 #3 0x7fb7b25ca2bf in jpc_dec_tileinit /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:841:24 #4 0x7fb7b25ca2bf in jpc_dec_process_sod /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:594 #5 0x7fb7b25d6853 in jpc_dec_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:425:10 #6 0x7fb7b25d6853 in jpc_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:262 #7 0x7fb7b25a6231 in jp2_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jp2/jp2_dec.c:218:21 #8 0x7fb7b2568214 in jas_image_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/base/jas_image.c:444:16 #9 0x50a3be in main /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/appl/imginfo.c:238:16 #10 0x7fb7b164878f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289 SUMMARY: AddressSanitizer: heap-buffer-overflow /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_t2dec.c:245:14 in jpc_dec_decodepkt Shadow bytes around the buggy address: 0x0c347fffbeb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c347fffbec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c347fffbed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c347fffbee0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c347fffbef0: 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa =>0x0c347fffbf00: fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c347fffbf10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c347fffbf20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c347fffbf30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c347fffbf40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c347fffbf50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==30315==ABORTING
Affected version:
2.0.10
Fixed version:
N/A
Commit fix:
N/A
Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.
CVE:
CVE-2017-6852
Reproducer:
https://github.com/asarubbo/poc/blob/master/00126-jasper-heapoverflow-jpc_dec_decodepkt
Timeline:
2017-01-25: bug discovered and reported upstream
2017-01-25: blog post about the issue
2017-03-12: CVE assigned
Note:
This bug was found with American Fuzzy Lop.
Permalink:
jasper: heap-based buffer overflow in jpc_dec_decodepkt (jpc_t2dec.c)