Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Heap-buffer-overflow in opj_jp2_apply_cdef #397

Closed
gcode-importer opened this issue Sep 17, 2014 · 6 comments
Closed

Heap-buffer-overflow in opj_jp2_apply_cdef #397

gcode-importer opened this issue Sep 17, 2014 · 6 comments
Assignees
@detonin
Labels
bug OpjVersion-2.x Priority-Critical Restrict-View-CoreTeam

Comments

@gcode-importer
Copy link

Originally reported on Google Code with ID 397

issue 414310: Heap-buffer-overflow in opj_jp2_apply_cdef
    http://code.google.com/p/chromium/issues/detail?id=414310

Reported by detonin on 2014-09-17 09:11:06
@gcode-importer
Copy link
Author

Reported by detonin on 2014-09-17 09:17:09

  • Labels added: OpjVersion-2.x

@gcode-importer
Copy link
Author 

Reproduced on trunk r2885

./bin/opj_decompress -i ../../data/issue397/0.jp2 -o 0.bmp

[INFO] COLR BOX meth value is not a regular value (254), so we will ignore the entire
Colour Specification box. 
[INFO] Start to read j2k main header (182).
[INFO] Main header has been correctly decoded.
[INFO] No decoded area parameters, set the decoded area to the whole image
WARNING in tgt_create tree->numnodes == 0, no tree created.
WARNING: No incltree created.
WARNING in tgt_create tree->numnodes == 0, no tree created.
WARNING: No imsbtree created.
WARNING in tgt_create tree->numnodes == 0, no tree created.
WARNING: No incltree created.
WARNING in tgt_create tree->numnodes == 0, no tree created.
WARNING: No imsbtree created.
WARNING in tgt_create tree->numnodes == 0, no tree created.
WARNING: No incltree created.
WARNING in tgt_create tree->numnodes == 0, no tree created.
WARNING: No imsbtree created.
WARNING in tgt_create tree->numnodes == 0, no tree created.
WARNING: No incltree created.
WARNING in tgt_create tree->numnodes == 0, no tree created.
WARNING: No imsbtree created.
WARNING in tgt_create tree->numnodes == 0, no tree created.
WARNING: No incltree created.
WARNING in tgt_create tree->numnodes == 0, no tree created.
WARNING: No imsbtree created.
WARNING in tgt_create tree->numnodes == 0, no tree created.
WARNING: No incltree created.
WARNING in tgt_create tree->numnodes == 0, no tree created.
WARNING: No imsbtree created.
WARNING in tgt_create tree->numnodes == 0, no tree created.
WARNING: No incltree created.
WARNING in tgt_create tree->numnodes == 0, no tree created.
WARNING: No imsbtree created.
WARNING in tgt_create tree->numnodes == 0, no tree created.
WARNING: No incltree created.
WARNING in tgt_create tree->numnodes == 0, no tree created.
WARNING: No imsbtree created.
WARNING in tgt_create tree->numnodes == 0, no tree created.
WARNING: No incltree created.
WARNING in tgt_create tree->numnodes == 0, no tree created.
WARNING: No imsbtree created.
[INFO] Header of tile 0 / 0 has been read.
[INFO] Tile 1/1 has been decoded.
[INFO] Image data has been updated with tile 1.

=================================================================
==33708==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x01e0069c at pc
0x007dbc55 bp 0xbff885d8 sp 0xbff885d4
READ of size 2 at 0x01e0069c thread T0
    #0 0x7dbc54 in opj_jp2_apply_cdef /Users/Matt/Dev/OpenJpeg/issue391/src/lib/openjp2/jp2.c:1129:4
    #1 0x7dad4c in opj_jp2_decode /Users/Matt/Dev/OpenJpeg/issue391/src/lib/openjp2/jp2.c:1324:7
    #2 0x7e5f63 in opj_decode /Users/Matt/Dev/OpenJpeg/issue391/src/lib/openjp2/openjpeg.c:412:10
    #3 0x7a86c in main /Users/Matt/Dev/OpenJpeg/issue391/src/bin/jp2/opj_decompress.c:821:10
    #4 0x94511700 in start (/usr/lib/system/libdyld.dylib+0x3700)
    #5 0x4 (<unknown module>)

0x01e0069c is located 0 bytes to the right of 12-byte region [0x01e00690,0x01e0069c)
allocated by thread T0 here:
    #0 0x2dfdba in wrap_malloc (/Users/Matt/Dev/llvm-clang-3.5.0-macosx-apple-darwin/lib/clang/3.5.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib+0x2fdba)
    #1 0x7da6b3 in opj_jp2_read_cdef /Users/Matt/Dev/OpenJpeg/issue391/src/lib/openjp2/jp2.c:1179:37
    #2 0x7d8cc7 in opj_jp2_read_jp2h /Users/Matt/Dev/OpenJpeg/issue391/src/lib/openjp2/jp2.c:2199:10
    #3 0x7e073d in opj_jp2_read_header_procedure /Users/Matt/Dev/OpenJpeg/issue391/src/lib/openjp2/jp2.c:1874:10
    #4 0x7de6c7 in opj_jp2_exec /Users/Matt/Dev/OpenJpeg/issue391/src/lib/openjp2/jp2.c:1925:26
    #5 0x7df37d in opj_jp2_read_header /Users/Matt/Dev/OpenJpeg/issue391/src/lib/openjp2/jp2.c:2306:8
    #6 0x7e5e79 in opj_read_header /Users/Matt/Dev/OpenJpeg/issue391/src/lib/openjp2/openjpeg.c:391:10
    #7 0x7a613 in main /Users/Matt/Dev/OpenJpeg/issue391/src/bin/jp2/opj_decompress.c:801:8
    #8 0x94511700 in start (/usr/lib/system/libdyld.dylib+0x3700)
    #9 0x4 (<unknown module>)

SUMMARY: AddressSanitizer: heap-buffer-overflow /Users/Matt/Dev/OpenJpeg/issue391/src/lib/openjp2/jp2.c:1129
opj_jp2_apply_cdef
Shadow bytes around the buggy address:
  0x203c0080: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x203c0090: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 01 fa
  0x203c00a0: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 01 fa
  0x203c00b0: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 01 fa
  0x203c00c0: fa fa 00 00 fa fa 00 00 fa fa 04 fa fa fa 00 fa
=>0x203c00d0: fa fa 00[04]fa fa 00 fa fa fa 00 04 fa fa 00 04
  0x203c00e0: fa fa 00 04 fa fa 00 04 fa fa 04 fa fa fa 00 fa
  0x203c00f0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa fd fa
  0x203c0100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x203c0110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x203c0120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  ASan internal:           fe
==33708==ABORTING

Reported by mayeut on 2014-09-20 13:24:06

- _Attachment: [0.jp2](https://storage.googleapis.com/google-code-attachments/openjpeg/issue-397/comment-2/0.jp2)_

@gcode-importer
Copy link
Author 

Antonin,

This patch deals with the security issue but we might wan't to abort with an error
rather than go on as does the patch. This is up to you.


./bin/opj_decompress -i ../../data/issue397/0.jp2 -o 0.bmp

[INFO] COLR BOX meth value is not a regular value (254), so we will ignore the entire
Colour Specification box. 
[INFO] Start to read j2k main header (182).
[INFO] Main header has been correctly decoded.
[INFO] No decoded area parameters, set the decoded area to the whole image
WARNING in tgt_create tree->numnodes == 0, no tree created.
.......
WARNING in tgt_create tree->numnodes == 0, no tree created.
WARNING: No imsbtree created.
[INFO] Header of tile 0 / 0 has been read.
[INFO] Tile 1/1 has been decoded.
[INFO] Image data has been updated with tile 1.

[INFO] Stream reached its end !
[INFO] Generated Outfile 0.bmp

Kakadu returns this :
kdu_expand -i ../../data/issue397/0.jp2 -o 0.bmp
Error in Kakadu File Format Support:
Malformed colour description (colr) box found in JP2-family data source. 
Insufficient fields, or illegal `approx' or `meth' field found in box.

Reported by mayeut on 2014-09-27 13:14:00

- _Attachment: [issue397.patch](https://storage.googleapis.com/google-code-attachments/openjpeg/issue-397/comment-3/issue397.patch)_

@gcode-importer
Copy link
Author 

+ cc Bo Xu from Foxit 

... so that you can follow what happens on these issues.

Reported by detonin on 2014-09-28 21:18:38

@gcode-importer
Copy link
Author 

I modified the patch.
According to ISO 15444-1, if cdef is present, it shall define a full list of channel
definitions.
So added a check for this.

Verified against the test suite with no regression.

./bin/opj_decompress -i ../../data/issue397/0.jp2 -o 0.bmp

[INFO] COLR BOX meth value is not a regular value (254), so we will ignore the entire
Colour Specification box. 
[INFO] Start to read j2k main header (182).
[INFO] Main header has been correctly decoded.
[INFO] No decoded area parameters, set the decoded area to the whole image
WARNING in tgt_create tree->numnodes == 0, no tree created.
.................
WARNING: No imsbtree created.
[INFO] Header of tile 1 / 1 has been read.
[INFO] Tile 1/1 has been decoded.
[INFO] Image data has been updated with tile 1.

[ERROR] Incomplete channel definitions.
ERROR -> opj_decompress: failed to decode image!

Reported by mayeut on 2014-10-10 21:05:39

  • Status changed: Verified
- _Attachment: [issue397.patch](https://storage.googleapis.com/google-code-attachments/openjpeg/issue-397/comment-5/issue397.patch)_

@gcode-importer
Copy link
Author 

This issue was closed by revision r2907.

Reported by detonin on 2014-10-21 12:54:13

  • Status changed: Fixed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@detonin detonin

Labels
bug OpjVersion-2.x Priority-Critical Restrict-View-CoreTeam
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@detonin @gcode-importer