NULL Pointer Access in function imagetopnm of convert.c:1943(jp2)

[YangY-Xiao]

DESCRIPTION
OPENJPEG null ptr dereference in convertbmp.c:980

VERSION
OPENJPEG-2.1.2

Address Sanitizer Output
==3411==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000 (pc 0x08146eaf bp 0xbfc960a8 sp 0xbfc96040 T0)
#0 0x8146eae (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x8146eae)
#1 0x813715c (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x813715c)
#2 0xb7403636 (/lib/i386-linux-gnu/libc.so.6+0x18636)
#3 0x805f327 (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x805f327)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x8146eae)

GDB Information
Breakpoint 4, imagetopnm (image=0x8d2d5c0, outfile=0xbfb08654 "image.pnm", force_split=0)
at /home/yang/openjpeg/openjpeg-2.1.2/src/bin/jp2/convert.c:1935
1935 red = image->comps[compno].data;
(rr) p red
$7 = (int *) 0xbfb05558
(rr) p image->comps[compno].data
$8 = (OPJ_INT32 *) 0x0
(rr) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x08051b76 in imagetopnm (image=0x8d2d5c0, outfile=0xbfb08654 "image.pnm", force_split=0)
at /home/yang/openjpeg/openjpeg-2.1.2/src/bin/jp2/convert.c:1943
1943 v = *red + adjustR; ++red;

Analysis
image->comps[compno].data = NULL and it was assigned to red, so the program accesses to red, segment fault occurs.

Poc
Contact me if you need Poc file at [email protected]

[1ucian0]

Please, refer to this issue as CVE-2016-9114

[rouault]

@Young-X Please verify if that occurs still with latest master. If so, please attach the reproducer to the ticket

[carnil]

@Young-X can you please provide the reproducer?

[YangY-Xiao]

There is no crash with latest version and PoC that triggered #857.
Sorry for replying late.

[carnil]

Hi

On Tue, Oct 24, 2017 at 01:26:25AM +0000, Young-X wrote: There is no crash with latest version and PoC that triggered #857. Sorry for replying late.

Thanks for confirming. Can you please still provide the reproducer file?