out of bounds writes

[setharnold]

openjpeg/src/lib/openmj2/mj2.c

Line 1556 in da5e897

tk->urn[urn_num].name[2] = cio_read(cio, 4);

Hello,

Please note name[2] and name[3] do not exist.

        tk->urn[urn_num].name[2] = cio_read(cio, 4);
        tk->urn[urn_num].name[3] = cio_read(cio, 4);

Thanks

[robert-ancell]

All the code seems to assume that name is of length 4, so I suspect the error is in src/lib/openmj2/mj2.h:

typedef struct mj2_urn {
    int name[2];
    int location[4];
} mj2_urn_t;

should be changed to:

typedef struct mj2_urn {
    int name[4];
    int location[4];
} mj2_urn_t;

There doesn't seem to be any spec information that's not behind a paywall, so I can't confirm this is correct.

It does seem wrong that these strings are limited to 16 characters - a draft spec that I did find suggested they were nul terminated strings so I wonder if this code is wrong?

The current code causes the last two integer values of name to be read/written into location.

[PhilArmstrong]

Is it possible they’re meant to be 128bit uuids, with the actual strings stored elsewhere in the source? The SPEC at https://www.ics.uci.edu/~dan/class/267/papers/jpeg2000.pdf appears to imply that every URL is associated with a UUID in the file.