Bug 1374329 (CVE-2016-7163) - CVE-2016-7163 openjpeg: Integer overflow in opj_pi_create_decode
Summary: CVE-2016-7163 openjpeg: Integer overflow in opj_pi_create_decode
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-7163
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1374339 1374340 1374341 1374342 1374343 1419772 1419773 1419774 1419775
Blocks: 1374338
TreeView+ depends on / blocked
 
Reported: 2016-09-08 12:57 UTC by Adam Mariš
Modified: 2019-09-29 13:56 UTC (History)
10 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2019-06-08 02:58:26 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:0559 0 normal SHIPPED_LIVE Moderate: openjpeg security update 2017-03-20 05:22:18 UTC
Red Hat Product Errata RHSA-2017:0838 0 normal SHIPPED_LIVE Moderate: openjpeg security update 2017-03-23 07:45:54 UTC

Description Adam Mariš 2016-09-08 12:57:57 UTC
An integer overflow in opj_pi_create_decode of pi.c was found that leads to out-of-bounds read and write in opj_pi_next_cprl of pi.c.

Upstream fix:

https://github.com/uclouvain/openjpeg/commit/c16bc057ba3f125051c9966cf1f5b68a05681de4
https://github.com/uclouvain/openjpeg/commit/ef01f18dfc6780b776d0674ed3e7415c6ef54d24

CVE assignment:

http://seclists.org/oss-sec/2016/q3/442

Comment 1 Adam Mariš 2016-09-08 13:16:18 UTC
Created openjpeg tracking bugs for this issue:

Affects: fedora-all [bug 1374339]

Comment 2 Adam Mariš 2016-09-08 13:16:26 UTC
Created mingw-openjpeg tracking bugs for this issue:

Affects: fedora-all [bug 1374341]

Comment 3 Adam Mariš 2016-09-08 13:16:33 UTC
Created openjpeg2 tracking bugs for this issue:

Affects: fedora-all [bug 1374340]
Affects: epel-all [bug 1374343]

Comment 4 Adam Mariš 2016-09-08 13:16:40 UTC
Created mingw-openjpeg2 tracking bugs for this issue:

Affects: fedora-all [bug 1374342]

Comment 5 Doran Moppert 2016-09-12 02:36:43 UTC
Test case is now included in the openjpeg-data repo:

https://github.com/uclouvain/openjpeg-data/blob/master/input/nonregression/issue826.jp2

Comment 6 Doran Moppert 2016-09-13 07:15:14 UTC
Upstream ticket (CVE assignment):

https://github.com/uclouvain/openjpeg/issues/826

More detail:

https://github.com/uclouvain/openjpeg/issues/825

Comment 8 Fedora Update System 2016-09-13 22:21:10 UTC
openjpeg2-2.1.1-3.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2016-09-15 18:40:44 UTC
openjpeg2-2.1.1-3.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2016-09-18 02:19:47 UTC
mingw-openjpeg2-2.1.1-3.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2016-09-18 05:21:31 UTC
mingw-openjpeg2-2.1.1-3.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2016-09-18 05:21:52 UTC
openjpeg2-2.1.1-3.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 13 Fedora Update System 2016-09-18 17:44:40 UTC
mingw-openjpeg2-2.1.1-3.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.

Comment 14 Doran Moppert 2016-09-20 07:49:02 UTC
Openjpeg-1 is tickled by the same reproducer, but the crash is in a completely different place.
I think it may require a distinct patch.

The ASAN warning is the same with upstream 1.5.1, 1.5.2 and RHEL patched versions:

==13320==WARNING: AddressSanitizer failed to allocate 0xfffffff400000300 bytes
==13320==AddressSanitizer's allocator is terminating the process instead of returning 0
==13320==If you don't like this behavior set allocator_may_return_null=1
==13320==AddressSanitizer CHECK failed: /builddir/build/BUILD/llvm-3.4.2.src/projects/compiler-rt/lib/sanitizer_common/sanitizer_allocator.cc:149 "((0)) != (0)" (0x0, 0x0)
    #0 0x46d29f in __asan::AsanCheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) (/home/dmoppert/repros/openjpeg/git-openjpeg/build-1.5.2/bin/j2k_to_image+0x46d29f)
    #1 0x472b01 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) (/home/dmoppert/repros/openjpeg/git-openjpeg/build-1.5.2/bin/j2k_to_image+0x472b01)
    #2 0x471840 in __sanitizer::AllocatorReturnNull() (/home/dmoppert/repros/openjpeg/git-openjpeg/build-1.5.2/bin/j2k_to_image+0x471840)
    #3 0x467336 in malloc (/home/dmoppert/repros/openjpeg/git-openjpeg/build-1.5.2/bin/j2k_to_image+0x467336)
    #4 0x7fc7f1b8a995 in tcd_malloc_decode_tile /home/dmoppert/repros/openjpeg/git-openjpeg/libopenjpeg/tcd.c:804
    #5 0x7fc7f1a615cf in j2k_read_eoc /home/dmoppert/repros/openjpeg/git-openjpeg/libopenjpeg/j2k.c:1691
    #6 0x7fc7f1a775d8 in j2k_decode /home/dmoppert/repros/openjpeg/git-openjpeg/libopenjpeg/j2k.c:2027
    #7 0x7fc7f1aa856e in opj_jp2_decode /home/dmoppert/repros/openjpeg/git-openjpeg/libopenjpeg/jp2.c:841
    #8 0x7fc7f1ad6379 in opj_decode_with_info /home/dmoppert/repros/openjpeg/git-openjpeg/libopenjpeg/openjpeg.c:168
    #9 0x7fc7f1ad5c9b in opj_decode /home/dmoppert/repros/openjpeg/git-openjpeg/libopenjpeg/openjpeg.c:157
    #10 0x47fca2 in main /home/dmoppert/repros/openjpeg/git-openjpeg/applications/codec/j2k_to_image.c:681
    #11 0x7fc7f0221b14 in __libc_start_main (/lib64/libc.so.6+0x21b14)
    #12 0x47d3dc in _start (/home/dmoppert/repros/openjpeg/git-openjpeg/build-1.5.2/bin/j2k_to_image+0x47d3dc)

Overflow is coming from the multiplication in tcd_malloc_decode_tile():

    band->precincts = (opj_tcd_precinct_t *) opj_malloc(res->pw * res->ph * sizeof(opj_tcd_precinct_t));

Putting some printf()s before this shows res->pw, res->ph taking on a lot of negative values.  It looks like opj_int_ceildivpow2() is going wrong earlier; a patch along the lines of below is probably needed:

  https://github.com/uclouvain/openjpeg/commit/38770403d

From a ticket referenced in that commit <https://github.com/uclouvain/openjpeg/issues/388>:

> seems the segfault came from a bug in a math function implementation (int_ceildivpow2).
> It had already been fixed in trunk but not yet backported in 1.5.

Comment 15 Doran Moppert 2016-12-09 05:09:39 UTC
> openjpeg-1.x is not affected by this flaw.  This report led to the discovery of CVE-2016-9675.

This observation was incorrect - Nikola Forró has provided a patch for this flaw on bug 1382202.

Comment 16 errata-xmlrpc 2017-03-20 01:22:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:0559 https://rhn.redhat.com/errata/RHSA-2017-0559.html

Comment 17 errata-xmlrpc 2017-03-23 03:46:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:0838 https://rhn.redhat.com/errata/RHSA-2017-0838.html


Note You need to log in before you can comment on or make changes to this bug.