NULL Pointer Access in function imagetopnm of convert.c(jp2):1289

[YangY-Xiao]

DESCRIPTION

OPENJPEG null ptr dereference in convert.c(jp2):1289

VERSION

OPENJPEG-2.1.2

Address Sanitizer Output

==23861==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000 (pc 0x08143ca7 bp 0xbfd92248 sp 0xbfd92040 T0)
#0 0x8143ca6 (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x8143ca6)
#1 0x813727f (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x813727f)
#2 0xb73d8636 (/lib/i386-linux-gnu/libc.so.6+0x18636)
#3 0x805f327 (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x805f327)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x8143ca6)

GDB Information

(rr) p image->comps[0]
$1 = {dx = 1, dy = 1, w = 20, h = 50, x0 = 0, y0 = 0, prec = 16, bpp = 0, sgnd = 0, resno_decoded = 0, factor = 0, data = 0x0, alpha = 0}

Poc

Contact me if you need Poc file at YangX92@hotmail.com

[1ucian0]

Please, refer to this issue as CVE-2016-9117

[rouault]

@Young-X Please verify if that occurs still with latest master. If so, please attach the reproducer to the ticket

[carnil]

@Young-X can you please provide the reproducer?

[YangY-Xiao]

There is no crash with latest version and PoC that triggered #860.
Sorry for replying late.

[YangY-Xiao]

wrong operation

[carnil]

On Tue, Oct 24, 2017 at 01:46:47AM +0000, Young-X wrote: There is no crash with latest version and PoC that triggered #860. Sorry for replying late.

Thanks for confirming. Can you please provide the reproducer?