Skip to content

OPENJPEG null ptr dereference in openjpeg-2.3.0/src/bin/jp2/convert.c:2243 #1152

Closed
@yngweijs

Description

@yngweijs

DESCRIPTION

OPENJPEG null ptr dereference in openjpeg-2.3.0/src/bin/jp2/convert.c:2243

VERSION
OPENJPEG-2.3.0

GDB Output

#0 0x0000555555560a5d in imagetopnm (image=0x555555a22660, outfile=0x7fffffffbcac "out.ppm", force_split=0) at /home/pwnjs/Desktop/openjpeg/openjpeg-2.3.0/src/bin/jp2/convert.c:2243
#1 0x000055555555a0e1 in main (argc=5, argv=0x7fffffffddf8) at /home/pwnjs/Desktop/openjpeg/openjpeg-2.3.0/src/bin/jp2/opj_decompress.c:1692
#2 0x00007ffff71e7b97 in __libc_start_main (main=0x5555555592ed

, argc=5, argv=0x7fffffffddf8, init=, fini=, rtld_fini=, stack_end=0x7fffffffdde8) at ../csu/libc-start.c:310
#3 0x00005555555567aa in _start ()

GDB Information

pwndbg> print red
$1 = (int *) 0x0
pwndbg> print image->comps[compno].data
$2 = (OPJ_INT32 *) 0x0
pwndbg> c
Continuing.
Program received signal SIGSEGV, Segmentation fault.
0x0000555555560a5d in imagetopnm (image=0x555555a22660, outfile=0x7fffffffbcac "out.ppm", force_split=0) at /home/pwnjs/Desktop/openjpeg/openjpeg-2.3.0/src/bin/jp2/convert.c:2243
2243 v = *red + adjustR;

Analysis

image->comps[compno].data = NULL and it was assigned to red, so the program accesses to red, segment fault occurs.

poc

Contact me if you need Poc file at yngweijs@gmail.com or mayfeelyang@gmail.com

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions