Skip to content

NULL Pointer Access in function imagetopnm of convert.c:1943(jp2) #857

@YangY-Xiao

Description

@YangY-Xiao

DESCRIPTION
OPENJPEG null ptr dereference in convertbmp.c:980

VERSION
OPENJPEG-2.1.2

Address Sanitizer Output
==3411==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000 (pc 0x08146eaf bp 0xbfc960a8 sp 0xbfc96040 T0)
#0 0x8146eae (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x8146eae)
#1 0x813715c (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x813715c)
#2 0xb7403636 (/lib/i386-linux-gnu/libc.so.6+0x18636)
#3 0x805f327 (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x805f327)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x8146eae)

GDB Information
Breakpoint 4, imagetopnm (image=0x8d2d5c0, outfile=0xbfb08654 "image.pnm", force_split=0)
at /home/yang/openjpeg/openjpeg-2.1.2/src/bin/jp2/convert.c:1935
1935 red = image->comps[compno].data;
(rr) p red
$7 = (int *) 0xbfb05558
(rr) p image->comps[compno].data
$8 = (OPJ_INT32 *) 0x0
(rr) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x08051b76 in imagetopnm (image=0x8d2d5c0, outfile=0xbfb08654 "image.pnm", force_split=0)
at /home/yang/openjpeg/openjpeg-2.1.2/src/bin/jp2/convert.c:1943
1943 v = *red + adjustR; ++red;

Analysis
image->comps[compno].data = NULL and it was assigned to red, so the program accesses to red, segment fault occurs.

Poc
Contact me if you need Poc file at YangX92@hotmail.com

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions