[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <1775367.VDhM2sPmdu@arcadia>
Date: Sun, 20 Nov 2016 15:23:26 +0100
From: Agostino Sarubbo <ago@...too.org>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: jasper: stack-based buffer overflow in jpc_tsfb_getbands2 (jpc_tsfb.c)
If suitable for a CVE please assign one. Thanks.
Description:
jasper is an open-source initiative to provide a free software-based reference
implementation of the codec specified in the JPEG-2000 Part-1 standard.
A crafted image, through an intensive fuzz on the 1.900.22 version revealed a
stack overflow.
The complete ASan output:
# imginfo -f $FILE
warning: trailing garbage in marker segment (9 bytes)
warning: trailing garbage in marker segment (28 bytes)
warning: trailing garbage in marker segment (40 bytes)
warning: ignoring unknown marker segment (0xffee)
type = 0xffee (UNKNOWN); len = 23;1f 32 ff ff ff 00 10 00 3d 4d 00 01 32 ff 00
e4 00 10 00 00 4f warning: trailing garbage in marker segment (14 bytes)
=================================================================
==9166==ERROR: AddressSanitizer: stack-buffer-overflow on address
0x7faf2e200c20 at pc 0x7faf320a985a bp 0x7ffd397b9b10 sp 0x7ffd397b9b08
WRITE of size 4 at 0x7faf2e200c20 thread T0
#0 0x7faf320a9859 in jpc_tsfb_getbands2 /tmp/portage/media-
libs/jasper-1.900.22/work/jasper-1.900.22/src/libjasper/jpc/jpc_tsfb.c:227:16
#1 0x7faf320a9009 in jpc_tsfb_getbands2 /tmp/portage/media-
libs/jasper-1.900.22/work/jasper-1.900.22/src/libjasper/jpc/jpc_tsfb.c:223:3
#2 0x7faf320a8b9f in jpc_tsfb_getbands /tmp/portage/media-
libs/jasper-1.900.22/work/jasper-1.900.22/src/libjasper/jpc/jpc_tsfb.c:187:3
#3 0x7faf3200eaa6 in jpc_dec_tileinit /tmp/portage/media-
libs/jasper-1.900.22/work/jasper-1.900.22/src/libjasper/jpc/jpc_dec.c:714:4
#4 0x7faf3200eaa6 in jpc_dec_process_sod /tmp/portage/media-
libs/jasper-1.900.22/work/jasper-1.900.22/src/libjasper/jpc/jpc_dec.c:560
#5 0x7faf3201c1c3 in jpc_dec_decode /tmp/portage/media-
libs/jasper-1.900.22/work/jasper-1.900.22/src/libjasper/jpc/jpc_dec.c:391:10
#6 0x7faf3201c1c3 in jpc_decode /tmp/portage/media-
libs/jasper-1.900.22/work/jasper-1.900.22/src/libjasper/jpc/jpc_dec.c:255
#7 0x7faf31f7e684 in jas_image_decode /tmp/portage/media-
libs/jasper-1.900.22/work/jasper-1.900.22/src/libjasper/base/jas_image.c:406:16
#8 0x509c9a in main /tmp/portage/media-
libs/jasper-1.900.22/work/jasper-1.900.22/src/appl/imginfo.c:203:16
#9 0x7faf3108761f in __libc_start_main /var/tmp/portage/sys-
libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289
#10 0x419988 in _init (/usr/bin/imginfo+0x419988)
Address 0x7faf2e200c20 is located in stack of thread T0 at offset 3104 in
frame
#0 0x7faf3200dbbf in jpc_dec_process_sod /tmp/portage/media-
libs/jasper-1.900.22/work/jasper-1.900.22/src/libjasper/jpc/jpc_dec.c:544
This frame has 1 object(s):
[32, 3104) 'bnds.i' 0x0ff665c38180: 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 f3 f3
f3 f3 f3
0x0ff665c38190: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff665c381a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff665c381b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff665c381c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff665c381d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==9166==ABORTING
Affected version:
1.900.22
Fixed version:
1.900.30
Commit fix:
https://github.com/mdadams/jasper/commit/1abc2e5a401a4bf1d5ca4df91358ce5df111f495
Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.
CVE:
N/A
Reproducer:
https://github.com/asarubbo/poc/blob/master/00047-jasper-stackoverflow-jpc_tsfb_getbands2
Timeline:
2016-11-09: bug discovered and reported to upstream
2016-11-20: upstream released a patch
2016-11-20: blog post about the issue
Note:
This bug was found with American Fuzzy Lop.
Permalink:
https://blogs.gentoo.org/ago/2016/11/20/jasper-stack-based-buffer-overflow-in-jpc_tsfb_getbands2-jpc_tsfb-c
--
Agostino Sarubbo
Gentoo Linux Developer
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
