Skip to content
Permalink
Browse files Browse the repository at this point in the history
Fixes #264.
The JP2 decoder was allowing the decoding of a code stream to be
attempted when the stream has inconsistent values for the number of
components and/or the component types.  For such invalid streams,
only a warning would be issued and decoding would proceed.  This is
dangerous, however, as it can lead to many unexpected paths through
the code, which in some cases have been demonstrated to result in
security vulnerabilities.  This code change makes decoding of these
types invalid code streams a hard error.
  • Loading branch information
mdadams committed Feb 7, 2021
1 parent c8f622d commit 41f214b
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 6 deletions.
Binary file added data/test/bad/poc_264.jp2
Binary file not shown.
16 changes: 10 additions & 6 deletions src/libjasper/jp2/jp2_dec.c
Expand Up @@ -232,7 +232,8 @@ jas_image_t *jp2_decode(jas_stream_t *in, const char *optstr)
the value specified in the code stream? */
if (dec->ihdr->data.ihdr.numcmpts != JAS_CAST(jas_uint,
jas_image_numcmpts(dec->image))) {
jas_eprintf("warning: number of components mismatch\n");
jas_eprintf("error: number of components mismatch (IHDR)\n");
goto error;
}

/* At least one component must be present. */
Expand All @@ -255,7 +256,8 @@ jas_image_t *jp2_decode(jas_stream_t *in, const char *optstr)
with the data in the code stream? */
if ((samedtype && dec->ihdr->data.ihdr.bpc != JP2_DTYPETOBPC(dtype)) ||
(!samedtype && dec->ihdr->data.ihdr.bpc != JP2_IHDR_BPCNULL)) {
jas_eprintf("warning: component data type mismatch (IHDR)\n");
jas_eprintf("error: component data type mismatch (IHDR)\n");
goto error;
}

/* Is the compression type supported? */
Expand All @@ -267,9 +269,10 @@ jas_image_t *jp2_decode(jas_stream_t *in, const char *optstr)
if (dec->bpcc) {
/* Is the number of components indicated in the BPCC box
consistent with the code stream data? */
if (dec->bpcc->data.bpcc.numcmpts != JAS_CAST(jas_uint, jas_image_numcmpts(
dec->image))) {
jas_eprintf("warning: number of components mismatch\n");
if (dec->bpcc->data.bpcc.numcmpts !=
JAS_CAST(jas_uint, jas_image_numcmpts(dec->image))) {
jas_eprintf("error: number of components mismatch (BPCC)\n");
goto error;
}
/* Is the component data type information indicated in the BPCC
box consistent with the code stream data? */
Expand All @@ -278,7 +281,8 @@ jas_image_t *jp2_decode(jas_stream_t *in, const char *optstr)
++i) {
if (jas_image_cmptdtype(dec->image, i) !=
JP2_BPCTODTYPE(dec->bpcc->data.bpcc.bpcs[i])) {
jas_eprintf("warning: component data type mismatch (BPCC)\n");
jas_eprintf("error: component data type mismatch (BPCC)\n");
goto error;
}
}
} else {
Expand Down

0 comments on commit 41f214b

Please sign in to comment.