invalid memory write in dec_clnpass (jpc_t1dec.c)

[asarubbo]

On 1.900.27:

warning: trailing garbage in marker segment (56 bytes)
warning: trailing garbage in marker segment (41 bytes)
warning: ignoring unknown marker segment (0xff7a)
type = 0xff7a (UNKNOWN); len = 48;00 32 35 ff f2 00 00 02 00 15 ff 80 01 00 00 64 00 0d 0e ff f4 14 fe 00 10 10 7f 87 31 20 d1 00 09 02 d1 d9 d1 d1 13 31 15 2a 00 01 29 ff warning: trailing garbage in marker segment (69 bytes)
warning: trailing garbage in marker segment (69 bytes)
warning: trailing garbage in marker segment (78 bytes)
warning: trailing garbage in marker segment (69 bytes)
warning: not enough tile data (1289 bytes)
warning: bad segmentation symbol
warning: bad segmentation symbol
warning: bad segmentation symbol
warning: corrupt code stream
ASAN:DEADLYSIGNAL
=================================================================
==24746==ERROR: AddressSanitizer: SEGV on unknown address 0x7ef94fe46c88 (pc 0x7efd4faa510d bp 0x7ffde2235af0 sp 0x7ffde2235900 T0)
==24746==The signal is caused by a WRITE memory access.
    #0 0x7efd4faa510c in dec_clnpass /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/jpc/jpc_t1dec.c:869:4
    #1 0x7efd4faa510c in jpc_dec_decodecblk /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/jpc/jpc_t1dec.c:283
    #2 0x7efd4fa9ef89 in jpc_dec_decodecblks /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/jpc/jpc_t1dec.c:177:11
    #3 0x7efd4fa394f1 in jpc_dec_tiledecode /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/jpc/jpc_dec.c:1085:6
    #4 0x7efd4fa2acdf in jpc_dec_process_sod /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/jpc/jpc_dec.c:658:7
    #5 0x7efd4fa346b3 in jpc_dec_decode /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/jpc/jpc_dec.c:425:10
    #6 0x7efd4fa346b3 in jpc_decode /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/jpc/jpc_dec.c:262
    #7 0x7efd4f996b84 in jas_image_decode /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/base/jas_image.c:444:16
    #8 0x509eed in main /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/appl/imginfo.c:219:16
    #9 0x7efd4ea9e61f in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289
    #10 0x419978 in _init (/usr/bin/imginfo+0x419978)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/jpc/jpc_t1dec.c:869:4 in dec_clnpass
==24746==ABORTING

Testcase: https://github.com/asarubbo/poc/blob/master/00055-jasper-invalidwrite-dec_clnpass

[thoger]

Similar to issue #88, d42b238 (included in 1.900.25) is the first commit that crashes on this reproducer. There's following failed assertion in earlier versions:

imginfo: jas_seq.c:90: jas_seq2d_create: Assertion `xstart <= xend && ystart <= yend' failed.

[alteholz]

this is CVE-2017-5503 ...

[MaxKellermann]

Since this project has been mostly dead for several years, we created a fork which aims to fix all vulnerabilities (of which there are many).
This bug will be fixed by jasper-maint/jasper#38 (merge pending)