-
Notifications
You must be signed in to change notification settings - Fork 103
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
memory leaks in jpc_dec_decodepkts #193
Comments
update,i rebuild with AddressSanitizer.this will show show symbolize on the stack traces. ➜ bin git:(master) ✗ gdb -q ./jasper Breakpoint 1, jpc_cod_gettsfb (qmfbid=1, numlvls=23) at /root/jasper/src/libjasper/jpc/jpc_tsfb.c:98 Breakpoint 1, jpc_cod_gettsfb (qmfbid=1, numlvls=23) at /root/jasper/src/libjasper/jpc/jpc_tsfb.c:98 Breakpoint 1, jpc_cod_gettsfb (qmfbid=1, numlvls=23) at /root/jasper/src/libjasper/jpc/jpc_tsfb.c:98 Breakpoint 1, jpc_cod_gettsfb (qmfbid=1, numlvls=23) at /root/jasper/src/libjasper/jpc/jpc_tsfb.c:98 ================================================================= Direct leak of 8288 byte(s) in 1 object(s) allocated from: Direct leak of 528 byte(s) in 4 object(s) allocated from: Direct leak of 104 byte(s) in 1 object(s) allocated from: Indirect leak of 142584 byte(s) in 481 object(s) allocated from: Indirect leak of 1728 byte(s) in 24 object(s) allocated from: Indirect leak of 104 byte(s) in 1 object(s) allocated from: Indirect leak of 64 byte(s) in 4 object(s) allocated from: SUMMARY: AddressSanitizer: 153400 byte(s) leaked in 516 allocation(s). leak in jpc_tsfb.c:98 jpc_tsfb_t *jpc_cod_gettsfb(int qmfbid, int numlvls)
} |
This was assigned CVE-2018-20622. |
After applying my patches I cannot reproduce this issue anymore. See |
AFAICS, the main problem here is the leak of tile data memory that is duplicate of #168 (and hence the CVE is duplicate of CVE-2017-13748). There is a proposed fix in #159 that resolves that problem. Whoever got the CVE-2018-20622 assigned, can you get it rejected as dupe properly? Also the current description of the CVE is incorrect - there's no problem in jas_malloc.c, and the problem is not specific to converting image to the |
After applying the patch from #159, I only see a minor 40 byte leak, that occurs in
https://github.com/mdadams/jasper/blob/version-2.0.16/src/libjasper/jpc/jpc_t2dec.c#L227-L338 |
Since this project has been mostly dead for several years, we created a fork which aims to fix all vulnerabilities (of which there are many). |
Changes: * Fix CVE-2018-9154 jasper-software/jasper#215 jasper-software/jasper#166 jasper-software/jasper#175 jasper-maint/jasper#8 * Fix CVE-2018-19541 jasper-software/jasper#199 jasper-maint/jasper#6 * Fix CVE-2016-9399, CVE-2017-13751 jasper-maint/jasper#1 * Fix CVE-2018-19540 jasper-software/jasper#182 jasper-maint/jasper#22 * Fix CVE-2018-9055 jasper-maint/jasper#9 * Fix CVE-2017-13748 jasper-software/jasper#168 * Fix CVE-2017-5503, CVE-2017-5504, CVE-2017-5505 jasper-maint/jasper#3 jasper-maint/jasper#4 jasper-maint/jasper#5 jasper-software/jasper#88 jasper-software/jasper#89 jasper-software/jasper#90 * Fix CVE-2018-9252 jasper-maint/jasper#16 * Fix CVE-2018-19139 jasper-maint/jasper#14 * Fix CVE-2018-19543, CVE-2017-9782 jasper-maint/jasper#13 jasper-maint/jasper#18 jasper-software/jasper#140 jasper-software/jasper#182 * Fix CVE-2018-20570 jasper-maint/jasper#11 jasper-software/jasper#191 * Fix CVE-2018-20622 jasper-maint/jasper#12 jasper-software/jasper#193 * Fix CVE-2016-9398 jasper-maint/jasper#10 * Fix CVE-2017-14132 jasper-maint/jasper#17 * Fix CVE-2017-5499 jasper-maint/jasper#2 jasper-software/jasper#63 * Fix CVE-2018-18873 jasper-maint/jasper#15 jasper-software/jasper#184 * Fix jasper-software/jasper#207 * Fix jasper-software/jasper#194 part 1 * Fix CVE-2017-13750 jasper-software/jasper#165 jasper-software/jasper#174 * New option -DJAS_ENABLE_HIDDEN=true to not export internal symbols in the public symbol table * Fix various memory leaks * Plenty of code cleanups, and performance improvements
Fixes the following security issues: * Fix CVE-2018-9154 jasper-software/jasper#215 jasper-software/jasper#166 jasper-software/jasper#175 jasper-maint/jasper#8 * Fix CVE-2018-19541 jasper-software/jasper#199 jasper-maint/jasper#6 * Fix CVE-2016-9399, CVE-2017-13751 jasper-maint/jasper#1 * Fix CVE-2018-19540 jasper-software/jasper#182 jasper-maint/jasper#22 * Fix CVE-2018-9055 jasper-maint/jasper#9 * Fix CVE-2017-13748 jasper-software/jasper#168 * Fix CVE-2017-5503, CVE-2017-5504, CVE-2017-5505 jasper-maint/jasper#3 jasper-maint/jasper#4 jasper-maint/jasper#5 jasper-software/jasper#88 jasper-software/jasper#89 jasper-software/jasper#90 * Fix CVE-2018-9252 jasper-maint/jasper#16 * Fix CVE-2018-19139 jasper-maint/jasper#14 * Fix CVE-2018-19543, CVE-2017-9782 jasper-maint/jasper#13 jasper-maint/jasper#18 jasper-software/jasper#140 jasper-software/jasper#182 * Fix CVE-2018-20570 jasper-maint/jasper#11 jasper-software/jasper#191 * Fix CVE-2018-20622 jasper-maint/jasper#12 jasper-software/jasper#193 * Fix CVE-2016-9398 jasper-maint/jasper#10 * Fix CVE-2017-14132 jasper-maint/jasper#17 * Fix CVE-2017-5499 jasper-maint/jasper#2 jasper-software/jasper#63 * Fix CVE-2018-18873 jasper-maint/jasper#15 jasper-software/jasper#184 * Fix CVE-2017-13750 jasper-software/jasper#165 jasper-software/jasper#174 Furthermore, drop now upstreamed patches and change to the new jasper-software upstream location. Signed-off-by: Michael Vetter <jubalh@iodoru.org> [Peter: reword for security bump] Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security issues: * Fix CVE-2018-9154 jasper-software/jasper#215 jasper-software/jasper#166 jasper-software/jasper#175 jasper-maint/jasper#8 * Fix CVE-2018-19541 jasper-software/jasper#199 jasper-maint/jasper#6 * Fix CVE-2016-9399, CVE-2017-13751 jasper-maint/jasper#1 * Fix CVE-2018-19540 jasper-software/jasper#182 jasper-maint/jasper#22 * Fix CVE-2018-9055 jasper-maint/jasper#9 * Fix CVE-2017-13748 jasper-software/jasper#168 * Fix CVE-2017-5503, CVE-2017-5504, CVE-2017-5505 jasper-maint/jasper#3 jasper-maint/jasper#4 jasper-maint/jasper#5 jasper-software/jasper#88 jasper-software/jasper#89 jasper-software/jasper#90 * Fix CVE-2018-9252 jasper-maint/jasper#16 * Fix CVE-2018-19139 jasper-maint/jasper#14 * Fix CVE-2018-19543, CVE-2017-9782 jasper-maint/jasper#13 jasper-maint/jasper#18 jasper-software/jasper#140 jasper-software/jasper#182 * Fix CVE-2018-20570 jasper-maint/jasper#11 jasper-software/jasper#191 * Fix CVE-2018-20622 jasper-maint/jasper#12 jasper-software/jasper#193 * Fix CVE-2016-9398 jasper-maint/jasper#10 * Fix CVE-2017-14132 jasper-maint/jasper#17 * Fix CVE-2017-5499 jasper-maint/jasper#2 jasper-software/jasper#63 * Fix CVE-2018-18873 jasper-maint/jasper#15 jasper-software/jasper#184 * Fix CVE-2017-13750 jasper-software/jasper#165 jasper-software/jasper#174 Furthermore, drop now upstreamed patches and change to the new jasper-software upstream location. Signed-off-by: Michael Vetter <jubalh@iodoru.org> [Peter: reword for security bump] Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit d0f7b24) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security issues: * Fix CVE-2018-9154 jasper-software/jasper#215 jasper-software/jasper#166 jasper-software/jasper#175 jasper-maint/jasper#8 * Fix CVE-2018-19541 jasper-software/jasper#199 jasper-maint/jasper#6 * Fix CVE-2016-9399, CVE-2017-13751 jasper-maint/jasper#1 * Fix CVE-2018-19540 jasper-software/jasper#182 jasper-maint/jasper#22 * Fix CVE-2018-9055 jasper-maint/jasper#9 * Fix CVE-2017-13748 jasper-software/jasper#168 * Fix CVE-2017-5503, CVE-2017-5504, CVE-2017-5505 jasper-maint/jasper#3 jasper-maint/jasper#4 jasper-maint/jasper#5 jasper-software/jasper#88 jasper-software/jasper#89 jasper-software/jasper#90 * Fix CVE-2018-9252 jasper-maint/jasper#16 * Fix CVE-2018-19139 jasper-maint/jasper#14 * Fix CVE-2018-19543, CVE-2017-9782 jasper-maint/jasper#13 jasper-maint/jasper#18 jasper-software/jasper#140 jasper-software/jasper#182 * Fix CVE-2018-20570 jasper-maint/jasper#11 jasper-software/jasper#191 * Fix CVE-2018-20622 jasper-maint/jasper#12 jasper-software/jasper#193 * Fix CVE-2016-9398 jasper-maint/jasper#10 * Fix CVE-2017-14132 jasper-maint/jasper#17 * Fix CVE-2017-5499 jasper-maint/jasper#2 jasper-software/jasper#63 * Fix CVE-2018-18873 jasper-maint/jasper#15 jasper-software/jasper#184 * Fix CVE-2017-13750 jasper-software/jasper#165 jasper-software/jasper#174 Furthermore, drop now upstreamed patches and change to the new jasper-software upstream location. Signed-off-by: Michael Vetter <jubalh@iodoru.org> [Peter: reword for security bump] Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit d0f7b24) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
hi,jasper team,when i convert jp2 file,i found a memory leak bug reported by AddressSanitizer.
the version is 2.0.14.
jasper-jpc_dec_decodepkts-memory-leak.zip
./jasper --input jasper-jpc_dec_decodepkts-memory-leak --output /dev/null --output-format jp2
warning: trailing garbage in marker segment (14 bytes)
warning: trailing garbage in marker segment (2 bytes)
warning: trailing garbage in marker segment (14 bytes)
warning: trailing garbage in marker segment (14 bytes)
warning: trailing garbage in marker segment (14 bytes)
warning: trailing garbage in marker segment (14 bytes)
alignment failed
jpc_dec_decodepkts failed
error: cannot decode code stream
error: cannot load image data
=================================================================
==30640==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 256 byte(s) in 1 object(s) allocated from:
#0 0x4b9798 (/root/fuzz/jasper/local/bin/jasper+0x4b9798)
#1 0x7f2b6de2f9eb (/root/fuzz/jasper/local/lib/libjasper.so.4+0x7c9eb)
Direct leak of 184 byte(s) in 1 object(s) allocated from:
#0 0x4b9798 (/root/fuzz/jasper/local/bin/jasper+0x4b9798)
#1 0x7f2b6de2f663 (/root/fuzz/jasper/local/lib/libjasper.so.4+0x7c663)
#2 0x7f2b6de957c2 (/root/fuzz/jasper/local/lib/libjasper.so.4+0xe27c2)
Direct leak of 48 byte(s) in 1 object(s) allocated from:
#0 0x4b9798 (/root/fuzz/jasper/local/bin/jasper+0x4b9798)
#1 0x7f2b6de2f663 (/root/fuzz/jasper/local/lib/libjasper.so.4+0x7c663)
Direct leak of 40 byte(s) in 1 object(s) allocated from:
#0 0x4b9798 (/root/fuzz/jasper/local/bin/jasper+0x4b9798)
#1 0x7f2b6de2f663 (/root/fuzz/jasper/local/lib/libjasper.so.4+0x7c663)
#2 0x7f2b6de8b1b0 (/root/fuzz/jasper/local/lib/libjasper.so.4+0xd81b0)
#3 0x7f2b6de957c2 (/root/fuzz/jasper/local/lib/libjasper.so.4+0xe27c2)
Indirect leak of 88976 byte(s) in 89 object(s) allocated from:
#0 0x4b9798 (/root/fuzz/jasper/local/bin/jasper+0x4b9798)
#1 0x7f2b6de2f663 (/root/fuzz/jasper/local/lib/libjasper.so.4+0x7c663)
Indirect leak of 26304 byte(s) in 148 object(s) allocated from:
#0 0x4b9798 (/root/fuzz/jasper/local/bin/jasper+0x4b9798)
#1 0x7f2b6de2f9eb (/root/fuzz/jasper/local/lib/libjasper.so.4+0x7c9eb)
#2 0x7f2b6de957c2 (/root/fuzz/jasper/local/lib/libjasper.so.4+0xe27c2)
Indirect leak of 9728 byte(s) in 158 object(s) allocated from:
#0 0x4b9798 (/root/fuzz/jasper/local/bin/jasper+0x4b9798)
#1 0x7f2b6de2f9eb (/root/fuzz/jasper/local/lib/libjasper.so.4+0x7c9eb)
Indirect leak of 576 byte(s) in 24 object(s) allocated from:
#0 0x4b9798 (/root/fuzz/jasper/local/bin/jasper+0x4b9798)
#1 0x7f2b6de2f9eb (/root/fuzz/jasper/local/lib/libjasper.so.4+0x7c9eb)
#2 0x7f2b6de882e5 (/root/fuzz/jasper/local/lib/libjasper.so.4+0xd52e5)
#3 0x7f2b6de957c2 (/root/fuzz/jasper/local/lib/libjasper.so.4+0xe27c2)
Indirect leak of 576 byte(s) in 24 object(s) allocated from:
#0 0x4b9798 (/root/fuzz/jasper/local/bin/jasper+0x4b9798)
#1 0x7f2b6de2f663 (/root/fuzz/jasper/local/lib/libjasper.so.4+0x7c663)
#2 0x7f2b6de8834f (/root/fuzz/jasper/local/lib/libjasper.so.4+0xd534f)
#3 0x7f2b6de957c2 (/root/fuzz/jasper/local/lib/libjasper.so.4+0xe27c2)
Indirect leak of 576 byte(s) in 24 object(s) allocated from:
#0 0x4b9798 (/root/fuzz/jasper/local/bin/jasper+0x4b9798)
#1 0x7f2b6de2f663 (/root/fuzz/jasper/local/lib/libjasper.so.4+0x7c663)
#2 0x7f2b6de882e5 (/root/fuzz/jasper/local/lib/libjasper.so.4+0xd52e5)
#3 0x7f2b6de957c2 (/root/fuzz/jasper/local/lib/libjasper.so.4+0xe27c2)
Indirect leak of 576 byte(s) in 24 object(s) allocated from:
#0 0x4b9798 (/root/fuzz/jasper/local/bin/jasper+0x4b9798)
#1 0x7f2b6de2f9eb (/root/fuzz/jasper/local/lib/libjasper.so.4+0x7c9eb)
#2 0x7f2b6de8834f (/root/fuzz/jasper/local/lib/libjasper.so.4+0xd534f)
#3 0x7f2b6de957c2 (/root/fuzz/jasper/local/lib/libjasper.so.4+0xe27c2)
Indirect leak of 504 byte(s) in 9 object(s) allocated from:
#0 0x4b9798 (/root/fuzz/jasper/local/bin/jasper+0x4b9798)
#1 0x7f2b6de2f663 (/root/fuzz/jasper/local/lib/libjasper.so.4+0x7c663)
#2 0x7f2b6de8b1b0 (/root/fuzz/jasper/local/lib/libjasper.so.4+0xd81b0)
#3 0x7f2b6de957c2 (/root/fuzz/jasper/local/lib/libjasper.so.4+0xe27c2)
Indirect leak of 64 byte(s) in 4 object(s) allocated from:
#0 0x4b9798 (/root/fuzz/jasper/local/bin/jasper+0x4b9798)
#1 0x7f2b6df3c528 (/root/fuzz/jasper/local/lib/libjasper.so.4+0x189528)
#2 0x7f2b6de957c2 (/root/fuzz/jasper/local/lib/libjasper.so.4+0xe27c2)
Indirect leak of 16 byte(s) in 1 object(s) allocated from:
#0 0x4b9798 (/root/fuzz/jasper/local/bin/jasper+0x4b9798)
#1 0x7f2b6de2f663 (/root/fuzz/jasper/local/lib/libjasper.so.4+0x7c663)
#2 0x7f2b6de957c2 (/root/fuzz/jasper/local/lib/libjasper.so.4+0xe27c2)
SUMMARY: AddressSanitizer: 128424 byte(s) leaked in 509 allocation(s).
The text was updated successfully, but these errors were encountered: