Bug 1416056 (CVE-2017-5503)

Summary: CVE-2017-5503 jasper: invalid memory write in dec_clnpass()
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bmcclain, cfergeau, dblechte, eedri, erik-fedora, jridky, lsurette, mgoldboi, michal.skrivanek, mike, rdieter, rh-spice-bugs, rjones, sbonazzo, sherold, slawomir, srevivo, ykaul
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: jasper 2.0.17 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 03:06:09 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1406406, 1406407, 1406409, 1434464    
Bug Blocks: 1449402    

Description Andrej Nemec 2017-01-24 13:52:27 UTC
A vulnerability was found in jasper. A crafted file could cause an invalid memory write.



Upstream bug:


Comment 1 Andrej Nemec 2017-01-24 14:21:48 UTC
Created mingw-jasper tracking bugs for this issue:

Affects: epel-7 [bug 1406409]

Comment 2 Andrej Nemec 2017-01-24 14:22:03 UTC
Created jasper tracking bugs for this issue:

Affects: epel-5 [bug 1406406]

Comment 3 Tomas Hoger 2017-03-14 14:27:08 UTC
Original reporter's advisory:


Relevant info from the advisory:

Another round of fuzzing shows that a crafted image causes an invalid memory write.

The complete ASan output:

# imginfo -f $FILE
==24746==ERROR: AddressSanitizer: SEGV on unknown address 0x7ef94fe46c88 (pc 0x7efd4faa510d bp 0x7ffde2235af0 sp 0x7ffde2235900 T0)
==24746==The signal is caused by a WRITE memory access.
    #0 0x7efd4faa510c in dec_clnpass /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/jpc/jpc_t1dec.c:869:4
    #1 0x7efd4faa510c in jpc_dec_decodecblk /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/jpc/jpc_t1dec.c:283
    #2 0x7efd4fa9ef89 in jpc_dec_decodecblks /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/jpc/jpc_t1dec.c:177:11
    #3 0x7efd4fa394f1 in jpc_dec_tiledecode /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/jpc/jpc_dec.c:1085:6
    #4 0x7efd4fa2acdf in jpc_dec_process_sod /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/jpc/jpc_dec.c:658:7
    #5 0x7efd4fa346b3 in jpc_dec_decode /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/jpc/jpc_dec.c:425:10
    #6 0x7efd4fa346b3 in jpc_decode /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/jpc/jpc_dec.c:262
    #7 0x7efd4f996b84 in jas_image_decode /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/base/jas_image.c:444:16
    #8 0x509eed in main /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/appl/imginfo.c:219:16
    #9 0x7efd4ea9e61f in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289
    #10 0x419978 in _init (/usr/bin/imginfo+0x419978)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/jpc/jpc_t1dec.c:869:4 in dec_clnpass

Affected version: 1.900.27

Fixed version: N/A

Commit fix: N/A

Credit: This bug was discovered by Agostino Sarubbo of Gentoo.

CVE: CVE-2017-5503


This issue has not been addressed yet and is still reproducible the current upstream version 2.0.12.

Comment 5 Tomas Hoger 2017-03-14 14:29:46 UTC
This problem can only be reproduced with Jasper versions including this upstream commit:


It was first included in upstream version 1.900.25.  Earlier versions do not seem to be affected.  The following assertion is raised in the earlier versions:

imginfo: jas_seq.c:90: jas_seq2d_create: Assertion `xstart <= xend && ystart <= yend' failed.

Comment 6 Tomas Hoger 2020-12-11 21:47:48 UTC
Upstream commit:


Fixed upstream in jasper 2.0.17.