jbig2dec-SEGV.md

SEGV in jbig2dec

Description

jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c. This vulnerability can lead to a Denial of Service (DoS).

It should be noted that jbig2dec (version 0.18-1ubuntu1) downloaded through apt-get may also trigger this vulnerability, which may endanger the system security of Debian users.

Location

jbig2_error: /test2/jbig2dec/jbig2.c:98

ASAN Log

./jbig2dec -d -e --hash Poc1jbig2dec

AddressSanitizer:DEADLYSIGNAL
=================================================================
==2809299==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000019 (pc 0x555555568fac bp 0x7fffffffd380 sp 0x7fffffffcd80 T0)
==2809299==The signal is caused by a READ memory access.
==2809299==Hint: address points to the zero page.
    #0 0x555555568fab in jbig2_error /test2/jbig2dec/jbig2.c:98
    #1 0x55555556565c in main /test2/jbig2dec/jbig2dec.c:781
    #2 0x7ffff7211082 in __libc_start_main ../csu/libc-start.c:308
    #3 0x55555556192d in _start (/test2/jbig2dec/jbig2dec+0xd92d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /test2/jbig2dec/jbig2.c:98 in jbig2_error
==2809299==ABORTING

Reproduction

git clone https://github.com/ArtifexSoftware/jbig2dec.git
cd jbig2dec
./autogen.sh
CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" CXXFLAGS=" -fsanitize=address -fno-omit-frame-pointer -g" ./configure --disable-shared
make -j24

./jbig2dec -d -e --hash Poc1jbig2dec

PoC

Poc1jbig2dec: https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/Poc1jbig2dec

Version

root@38ad1e4b9d16:/test2/jbig2dec# ./jbig2dec --version
jbig2dec 0.20

Reference

https://github.com/ArtifexSoftware/jbig2dec

Environment

ubuntu:20.04
gcc version 9.4.0 (Ubuntu 9.4.0-1ubuntu1~20.04.2)
clang version 10.0.0-4ubuntu1
afl-cc++4.09

Credit

Zeng Yunxiang

Song Jiaxuan