Created attachment 1137318 [details]
I would like to report a null pointer dereference in libjpeg library in rdppm.c:153. here is the details:
This bug can be used to cause a denial of service attack and some cases remote code execution if the library is used in a system accepts users input. please assign a cve for this issue.
$ cjpeg crasher
Starting program: /opt/libjpeg/bin/cjpeg crasher
Program received signal SIGSEGV, Segmentation fault.
*#0 get_text_gray_row (cinfo=0x7fffffffe2c0, sinfo=<optimized out="">) at rdppm.c:153
1 0x0000000000401996 in main (argc=0x2, argv=0x7fffffffe618) at cjpeg.c:6**42
2 0x00007ffff7738af5 in __libc_start_main () from /lib64/libc.so.6
3 0x0000000000401e2d in _start ()
*ptr++ = rescale[read_pbm_integer(cinfo, infile)];
=> 0x407b08 <get_text_gray_row+200>: movzx esi,BYTE PTR [r13+rcx*1+0x0]
gdb$ p $r13+$rcx*1+0x0
gdb$ $8 = 0x92d91bc1
gdb$ x/x 0x92d91bc1
0x92d91bc1: Cannot access memory at address 0x92d91bc1
please note that i have requested a CVE ID for this bug from CVE-assign.
MITRE has assigned the following CVE ID to the bug CVE-2016-3616.
After analyzing this issue, it seems that the flaw is in the cjpeg utility shipped with libjpeg and not in the library itself. The cjpeg utility is used to compress an image file and produce a JPEG image.
Interestingly when i run this file through netpbm (pgmtopbm), it correctly handles it and the following message is printed:
pamditherbw: ASCII decimal integer in file is too large to be processed.
pamtopnm: End of file encountered when trying to read a row from input file.
which shows that it is doing the right thing.
The above being said, i want to make this bug public, since it does not sound very serious, you ok with that?
Sure if the issue is only in the cjpeg utility, you can make this bug public. ty
This bug corresponds to the security flaw at: