null pointer dereference in BitmapHook

[sleicasper]

There is a null pointer dereference in BitmapHook in bitmaphook.cpp.

stack trace

==32572==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000074 (pc 0x7f889cc5dedd bp 0x000000000000 sp 0x7ffd95055cc0 T0)
==32572==The signal is caused by a READ memory access.
==32572==Hint: address points to the zero page.
    #0 0x7f889cc5dedc in fputc /build/glibc-SzIz7B/glibc-2.31/libio/fputc.c:32
    #1 0x560a4361d4b4 in BitmapHook(JPG_Hook*, JPG_TagItem*) /home/casper/targets/struct/libjpeg_th/dbg/SRC/cmd/bitmaphook.cpp:317
    #2 0x560a436326b5 in JPG_Hook::CallLong(JPG_TagItem*) ../interface/hooks.hpp:164
    #3 0x560a43645440 in BitMapHook::Release(JPG_Hook*, JPG_TagItem*, unsigned char, RectAngle<int> const&, ImageBitMap const*, Component const*, bool) /home/casper/targets/struct/libjpeg_th/dbg/SRC/interface/bitmaphook.cpp:239
    #4 0x560a436455b6 in BitMapHook::ReleaseClientData(RectAngle<int> const&, ImageBitMap const*, Component const*) /home/casper/targets/struct/libjpeg_th/dbg/SRC/interface/bitmaphook.cpp:262
    #5 0x560a439219e9 in BitmapCtrl::ReleaseUserData(BitMapHook*, RectAngle<int> const&, unsigned char, bool) /home/casper/targets/struct/libjpeg_th/dbg/SRC/control/bitmapctrl.cpp:193
    #6 0x560a43922018 in BitmapCtrl::ReleaseUserDataFromDecoding(BitMapHook*, RectangleRequest const*, bool) /home/casper/targets/struct/libjpeg_th/dbg/SRC/control/bitmapctrl.cpp:256
    #7 0x560a43661b9b in Image::ReconstructRegion(BitMapHook*, RectangleRequest const*) /home/casper/targets/struct/libjpeg_th/dbg/SRC/codestream/image.cpp:1117
    #8 0x560a4364a1e1 in JPEG::InternalDisplayRectangle(JPG_TagItem*) /home/casper/targets/struct/libjpeg_th/dbg/SRC/interface/jpeg.cpp:721
    #9 0x560a43649ed1 in JPEG::DisplayRectangle(JPG_TagItem*) /home/casper/targets/struct/libjpeg_th/dbg/SRC/interface/jpeg.cpp:699
    #10 0x560a4362ce98 in Reconstruct(char const*, char const*, int, char const*, bool) /home/casper/targets/struct/libjpeg_th/dbg/SRC/cmd/reconstruct.cpp:281
    #11 0x560a43619ea9 in main /home/casper/targets/struct/libjpeg_th/dbg/SRC/cmd/main.cpp:747
    #12 0x7f889cbf7082 in __libc_start_main ../csu/libc-start.c:308
    #13 0x560a436169ad in _start (/home/casper/targets/struct/libjpeg_th/dbg/SRC/jpeg+0x459ad)

poc:
poc.zip

reproduce:

1. compile libjpeg with address sanitizer
2. run ./jpeg ./poc /dev/null

[thorfdbg]

Am 29.05.2022 um 06:00 schrieb sleicasper:

There is a null pointer dereference in BitmapHook in bitmaphook.cpp.

I cannot reproduce. Please ensure that you use the latest version from git. That is, make a fresh clone, and recompile from it. jpeg poc out.ppm jpeg Copyright (C) 2012-2018 Thomas Richter, University of Stuttgart and Accusoft For license conditions, see README.license for details. *** Warning -1038 in Tables::ParseTables, line 1386, file tables.cpp *** Reason is: found invalid marker, probably a marker size is out of range *** Warning -1038 in Tables::ParseTables, line 1386, file tables.cpp *** Reason is: found invalid marker, probably a marker size is out of range *** Warning -1038 in Frame::StartParseHiddenScan, line 869, file frame.cpp *** Reason is: Start of Scan SOS marker missing *** Warning -1038 in Frame::ParseTrailer, line 1084, file frame.cpp *** Reason is: missing an EOI marker at the end of the stream *** Warning -1038 in Image::ParseTrailer, line 1463, file image.cpp *** Reason is: expecting an EOI marker at the end of the stream 0 bytes memory not yet released. 9177 bytes maximal required. 44 allocations performed. Greetings, Thomas

[sleicasper]

Hi,
I can reproduce this issue on latest version from github using command ./jpeg poc /dev/null.

[thorfdbg]

I can reproduce this issue on latest version from github using command |./jpeg poc /dev/null|.

Actually, this is not related to the core library code, only to the demo wrapper code due to the selection of the target "file name". The pgx writer cannot handle this properly. It is fixed, though. You should really not depend much on the code in "cmd" which is kept simple on purpose.

[thorfdbg]

Done