Heap-buffer-overflow in parse_cmdline_encoder

[gcode-importer]

Originally reported on Google Code with ID 403

Using r2285 

"/Users/Matt/Dev/OpenJpeg/issue-389/build/bin/opj_compress" "-i" "/Users/Matt/Dev/OpenJpeg/data/input/nonregression/tmp-issue-0062.raw"
"-o" "/Users/Matt/Dev/OpenJpeg/issue-389/build/tests/nonregression/Temporary/tmp-issue-0062-u.raw.j2k"
"-F" "512,512,1,16,u"
=================================================================
==4201==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000e058 at
pc 0x00010d639ec3 bp 0x7fff525c6690 sp 0x7fff525c6688
READ of size 4 at 0x60200000e058 thread T0
    #0 0x10d639ec2 in parse_cmdline_encoder /Users/Matt/Dev/OpenJpeg/issue-389/src/bin/jp2/opj_compress.c:1504:10
    #1 0x10d6354f7 in main /Users/Matt/Dev/OpenJpeg/issue-389/src/bin/jp2/opj_compress.c:1581:8
    #2 0x7fff8a6ad5fc in start (/usr/lib/system/libdyld.dylib+0x35fc)
    #3 0x6 (<unknown module>)

0x60200000e058 is located 0 bytes to the right of 8-byte region [0x60200000e050,0x60200000e058)
allocated by thread T0 here:
    #0 0x10d89fccf in wrap_malloc (/Users/Matt/Dev/llvm-clang-3.5.0-macosx-apple-darwin/lib/clang/3.5.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib+0x2bccf)
    #1 0x10d63870b in parse_cmdline_encoder /Users/Matt/Dev/OpenJpeg/issue-389/src/bin/jp2/opj_compress.c:632:62
    #2 0x10d6354f7 in main /Users/Matt/Dev/OpenJpeg/issue-389/src/bin/jp2/opj_compress.c:1581:8
    #3 0x7fff8a6ad5fc in start (/usr/lib/system/libdyld.dylib+0x35fc)
    #4 0x6 (<unknown module>)

SUMMARY: AddressSanitizer: heap-buffer-overflow /Users/Matt/Dev/OpenJpeg/issue-389/src/bin/jp2/opj_compress.c:1504
parse_cmdline_encoder
Shadow bytes around the buggy address:
  0x1c0400001bb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x1c0400001bc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x1c0400001bd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x1c0400001be0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x1c0400001bf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x1c0400001c00: fa fa fa fa fa fa fa fa fa fa 00[fa]fa fa fd fd
  0x1c0400001c10: fa fa 00 fa fa fa 00 00 fa fa 00 04 fa fa 00 04
  0x1c0400001c20: fa fa 00 04 fa fa 00 fa fa fa 00 00 fa fa 00 00
  0x1c0400001c30: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x1c0400001c40: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x1c0400001c50: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  ASan internal:           fe
==4201==ABORTING

Reported by mayeut on 2014-09-20 11:11:57

[gcode-importer]

Here's a patch for that.
Tested against test suite on CDash.
Shall get rid of valgrind errors on 1 component raw encoding tests

Reported by mayeut on 2014-09-20 11:15:36

• Status changed: Verified

---

- _Attachment: [issue403.patch](https://storage.googleapis.com/google-code-attachments/openjpeg/issue-403/comment-1/issue403.patch)_

[gcode-importer]

Antonin,

Could you please apply this patch ?

Reported by mayeut on 2014-09-27 13:14:42

[gcode-importer]

This issue was closed by revision r2889.

Reported by detonin on 2014-09-30 09:48:32

• Status changed: Fixed