Description
DESCRIPTION
OPENJPEG null ptr dereference in openjpeg-2.3.0/src/bin/jp2/convert.c:2243
VERSION
OPENJPEG-2.3.0
GDB Output
#0 0x0000555555560a5d in imagetopnm (image=0x555555a22660, outfile=0x7fffffffbcac "out.ppm", force_split=0) at /home/pwnjs/Desktop/openjpeg/openjpeg-2.3.0/src/bin/jp2/convert.c:2243
#1 0x000055555555a0e1 in main (argc=5, argv=0x7fffffffddf8) at /home/pwnjs/Desktop/openjpeg/openjpeg-2.3.0/src/bin/jp2/opj_decompress.c:1692
#2 0x00007ffff71e7b97 in __libc_start_main (main=0x5555555592ed
#3 0x00005555555567aa in _start ()
GDB Information
pwndbg> print red
$1 = (int *) 0x0
pwndbg> print image->comps[compno].data
$2 = (OPJ_INT32 *) 0x0
pwndbg> c
Continuing.
Program received signal SIGSEGV, Segmentation fault.
0x0000555555560a5d in imagetopnm (image=0x555555a22660, outfile=0x7fffffffbcac "out.ppm", force_split=0) at /home/pwnjs/Desktop/openjpeg/openjpeg-2.3.0/src/bin/jp2/convert.c:2243
2243 v = *red + adjustR;
Analysis
image->comps[compno].data = NULL and it was assigned to red, so the program accesses to red, segment fault occurs.
poc
Contact me if you need Poc file at yngweijs@gmail.com or mayfeelyang@gmail.com