Bug 1294039 - jasper: Integer overflow in jas_matrix_create()
Summary: jasper: Integer overflow in jas_matrix_create()
Status: CLOSED DUPLICATE of bug 461476
Alias: None
Product: Fedora
Classification: Fedora
Component: jasper
Version: 23
Hardware: All
OS: All
Target Milestone: ---
Assignee: Rex Dieter
QA Contact: Fedora Extras Quality Assurance
: 1296950 (view as bug list)
Depends On:
Blocks: CVE-2015-8751
TreeView+ depends on / blocked
Reported: 2015-12-24 08:37 UTC by limingxing
Modified: 2016-01-13 07:36 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Release Note
Doc Text:
Clone Of:
Last Closed: 2016-01-11 12:49:42 UTC
Type: Bug

Attachments (Terms of Use)
crash pos (212 bytes, image/jp2)
2015-12-24 08:37 UTC, limingxing
no flags Details

Description limingxing 2015-12-24 08:37:22 UTC
Created attachment 1109156 [details]
crash pos

We find a vulnerability in the way JasPer's jas_matrix_create() function parsed certain JPEG 2000 image files. 

jas_matrix_t *jas_matrix_create(int numrows, int numcols)

	if (matrix->maxrows_ > 0) {
		if (!(matrix->rows_ = jas_malloc(matrix->maxrows_ *
		  sizeof(jas_seqent_t *)))) {


matrix->maxrows_ > 0 ,but matrix->maxrows_ *sizeof(jas_seqent_t *) can cause Integer overflow.

Reported by Qihoo 360 Codesafe Team

Comment 1 Martin Prpič 2016-01-08 14:30:27 UTC
*** Bug 1296950 has been marked as a duplicate of this bug. ***

Comment 2 Cedric Buissart 2016-01-11 12:49:42 UTC

*** This bug has been marked as a duplicate of bug 461476 ***

Comment 3 limingxing 2016-01-13 05:00:26 UTC
You are right,I made a mistake,I omit the patch.

And,I find another vulnerability about Jasper.
I was successful in reproducing this issuel in the jasper-1.900.1-31.fc23.src.

Please see:

Note You need to log in before you can comment on or make changes to this bug.