Bug 1318509 - null pointer dereference in libjpeg library in cjpeg
Summary: null pointer dereference in libjpeg library in cjpeg
Status: ON_QA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: libjpeg-turbo   
(Show other bugs)
Version: 7.4
Hardware: Unspecified
OS: Linux
Target Milestone: rc
: ---
Assignee: Nikola Forró
QA Contact: Miroslav Hradílek
Keywords: Security
Depends On:
TreeView+ depends on / blocked
Reported: 2016-03-17 06:16 UTC by Aladdin Mubaied
Modified: 2019-01-31 15:44 UTC (History)
2 users (show)

Fixed In Version: libjpeg-turbo-1.2.90-7.el7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
crasher (25 bytes, application/octet-stream)
2016-03-17 06:16 UTC, Aladdin Mubaied
no flags Details

Description Aladdin Mubaied 2016-03-17 06:16:11 UTC
Created attachment 1137318 [details]

I would like to report a null pointer dereference in libjpeg library in rdppm.c:153. here is the details:

This bug can be used to cause a denial of service attack and some cases remote code execution if the library is used in a system accepts users input. please assign a cve for this issue.

$ cjpeg crasher
Starting program: /opt/libjpeg/bin/cjpeg crasher
Program received signal SIGSEGV, Segmentation fault.

*#0 get_text_gray_row (cinfo=0x7fffffffe2c0, sinfo=<optimized out="">) at rdppm.c:153
1 0x0000000000401996 in main (argc=0x2, argv=0x7fffffffe618) at cjpeg.c:6**42
2 0x00007ffff7738af5 in __libc_start_main () from /lib64/libc.so.6
3 0x0000000000401e2d in _start ()

*ptr++ = rescale[read_pbm_integer(cinfo, infile)];
=> 0x407b08 <get_text_gray_row+200>: movzx esi,BYTE PTR [r13+rcx*1+0x0]

gdb$ p $r13+$rcx*1+0x0

gdb$ $8 = 0x92d91bc1
gdb$ x/x 0x92d91bc1
0x92d91bc1: Cannot access memory at address 0x92d91bc1

Aladdin Mubaied

Comment 2 Aladdin Mubaied 2016-03-18 21:58:53 UTC
please note that i have requested a CVE ID for this bug from CVE-assign.

Comment 3 Aladdin Mubaied 2016-03-18 23:25:02 UTC
MITRE has assigned the following CVE ID to the bug CVE-2016-3616.

Comment 4 Huzaifa S. Sidhpurwala 2016-03-25 04:38:03 UTC

After analyzing this issue, it seems that the flaw is in the cjpeg utility shipped with libjpeg and not in the library itself. The cjpeg utility is used to compress an image file and produce a JPEG image.

Interestingly when i run this file through netpbm (pgmtopbm), it correctly handles it and the following message is printed:

pamditherbw: ASCII decimal integer in file is too large to be processed.  
23 1
pamtopnm: End of file encountered when trying to read a row from input file.

which shows that it is doing the right thing.

The above being said, i want to make this bug public, since it does not sound very serious, you ok with that?

Comment 5 Aladdin Mubaied 2016-03-25 04:46:14 UTC
Sure if the issue is only in the cjpeg utility, you can make this bug public. ty

Comment 6 Huzaifa S. Sidhpurwala 2016-03-30 09:12:51 UTC
This bug corresponds to the security flaw at:

Note You need to log in before you can comment on or make changes to this bug.