Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NULL dereference can cause by malformed file #908

Closed
insuyun opened this issue Apr 1, 2017 · 1 comment
Closed

NULL dereference can cause by malformed file #908

insuyun opened this issue Apr 1, 2017 · 1 comment
Labels

Comments

@insuyun
Copy link

insuyun commented Apr 1, 2017

Hi, all. By fuzzing I found a NULL derefence in openjpeg.
Here is the file and ASAN result.
Thanks.

./bin/opj_decompress -i ~/projects/qsym-eval/apps/openjpeg/output/afl2/crashes/id:000026,sig:11,src:003366+000047,op:splice,rep:4 -o a.raw

===========================================
The extension of this file is incorrect.
FOUND ep:4. SHOULD BE .jp2
===========================================

[INFO] JP2 IHDR box: compression type indicate that the file is not a conforming JP2 file (41)
[INFO] Start to read j2k main header (85).
[INFO] Main header has been correctly decoded.
[INFO] No decoded area parameters, set the decoded area to the whole image
[INFO] Stream reached its end !
Raw image characteristics: 3 components
Component 0 characteristics: 64979x64x7 unsigned
ASAN:SIGSEGV
=================================================================
==72379== ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000040cf23 sp 0x7fffffff91e0 bp 0x7fffffff9380 T0)
AddressSanitizer can not provide additional info.
    #0 0x40cf22 (/home/insu/projects/openjpeg/build/bin/opj_decompress+0x40cf22)
    #1 0x4149d9 (/home/insu/projects/openjpeg/build/bin/opj_decompress+0x4149d9)
    #2 0x409c77 (/home/insu/projects/openjpeg/build/bin/opj_decompress+0x409c77)
    #3 0x7ffff3dfaf44 (/lib/x86_64-linux-gnu/libc-2.19.so+0x21f44)
    #4 0x402de8 (/home/insu/projects/openjpeg/build/bin/opj_decompress+0x402de8)
==72379== ABORTING
@rouault
Copy link
Collaborator

rouault commented Jul 29, 2017

Cannot replicate with current master. Closing as fixed

@rouault rouault closed this as completed Jul 29, 2017
@detonin detonin added the bug label Aug 3, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants