{"id":1094,"date":"2017-01-16T12:40:25","date_gmt":"2017-01-16T10:40:25","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=1094"},"modified":"2017-01-25T18:02:39","modified_gmt":"2017-01-25T16:02:39","slug":"jasper-multiple-crashes-with-ubsan","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/01\/16\/jasper-multiple-crashes-with-ubsan\/","title":{"rendered":"jasper: multiple crashes with UBSAN"},"content":{"rendered":"

Description<\/strong>:
\njasper<\/a> is an open-source initiative to provide a free software-based reference implementation of the codec specified in the JPEG-2000 Part-1 standard.<\/p>\n

With the undefined behavior sanitizer enabled, jasper crashes showing some left shift and some signed integer overflow.<\/p>\n

Affected version \/ Tested on:<\/strong>
\n1.900.17
\nFixed version:<\/strong>
\nN\/A
\nCommit fix:<\/strong>
\nN\/A
\nReproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00017-jasper-leftshift-jas_math_h<\/a>
\nRelevant part of the stacktrace:<\/strong><\/p>\n

# imginfo -f $FILE\r\n\/tmp\/portage\/media-libs\/jasper-1.900.17\/work\/jasper-1.900.17\/src\/libjasper\/include\/jasper\/jas_math.h:156:11: runtime error: left shift of negative value -185\r\n<\/font><\/pre>\n
CVE:<\/strong>
\nCVE-2017-5498<\/p>\n
#################################################<\/p>\n
Affected version \/ Tested on:<\/strong>
\n1.900.17
\nFixed version:<\/strong>
\nN\/A
\nCommit fix:<\/strong>
\nN\/A
\nReproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00018-jasper-signedintoverflow-jpc_dec_c<\/a>
\nRelevant part of the stacktrace:<\/strong><\/p>\n
# imginfo -f $FILE\r\n\/tmp\/portage\/media-libs\/jasper-1.900.17\/work\/jasper-1.900.17\/src\/libjasper\/jpc\/jpc_dec.c:1838:9: runtime error: signed integer overflow: -64356352 * 6359082673847140352 cannot be represented in type 'long'<\/font><\/pre>\n
CVE:<\/strong>
\nCVE-2017-5499<\/p>\n
#################################################<\/p>\n
Affected version \/ Tested on:<\/strong>
\n1.900.17
\nFixed version:<\/strong>
\nN\/A
\nCommit fix:<\/strong>
\nN\/A
\nReproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00019-jasper-leftshift-jpc_dec_c<\/a>
\nRelevant part of the stacktrace:<\/strong><\/p>\n
# imginfo -f $FILE\r\n\/tmp\/portage\/media-libs\/jasper-1.900.17\/work\/jasper-1.900.17\/src\/libjasper\/jpc\/jpc_dec.c:1819:40: runtime error: shift exponent 117 is too large for 64-bit type 'jpc_fix_t' (aka 'long')\r\n<\/font><\/pre>\n
CVE:<\/strong>
\nCVE-2017-5500<\/p>\n
#################################################<\/p>\n
Affected version \/ Tested on:<\/strong>
\n1.900.17
\nFixed version:<\/strong>
\nN\/A
\nCommit fix:<\/strong>
\nN\/A
\nReproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00022-jasper-signedintoverflow-jpc_tsfb_c<\/a>
\nRelevant part of the stacktrace:<\/strong><\/p>\n
# imginfo -f $FILE\r\n\/tmp\/portage\/media-libs\/jasper-1.900.17\/work\/jasper-1.900.17\/src\/libjasper\/jpc\/jpc_tsfb.c:233:35: runtime error: signed integer overflow: 2013306369 + 251691968 cannot be represented in type 'int'\r\n<\/font><\/pre>\n
CVE:<\/strong>
\nCVE-2017-5501<\/p>\n
#################################################<\/p>\n
Affected version \/ Tested on:<\/strong>
\n1.900.17
\nFixed version:<\/strong>
\nN\/A
\nCommit fix:<\/strong>
\nN\/A
\nReproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00030-jasper-leftshift-jp2_dec_c<\/a>
\nRelevant part of the stacktrace:<\/strong><\/p>\n
# imginfo -f $FILE\r\n\/tmp\/portage\/media-libs\/jasper-1.900.17\/work\/jasper-1.900.17\/src\/libjasper\/jp2\/jp2_dec.c:485:49: runtime error: left shift of negative value -26\r\n<\/font><\/pre>\n
CVE:<\/strong>
\nCVE-2017-5502<\/p>\n
Credit:<\/strong>
\nThese bugs were discovered by Agostino Sarubbo of Gentoo.<\/p>\n
Timeline:<\/strong>
\n2016-10-28: bug discovered and reported to upstream
\n2017-01-16: blog post about the issues
\n2017-01-17: CVE assigned<\/p>\n
Note:<\/strong>
\nThese bugs were found with American Fuzzy Lop<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
jasper: multiple crashes with UBSAN<\/a><\/p><\/blockquote>\n