Bug 1485272

Created attachment 1318057 [details]
Triggered by  "./imginfo -f POC1"

Description of problem:

There is a reachable assertion abort in function JPC_NOMINALGAIN() of JasPer that will lead to remote denial of service attack.

Version-Release number of selected component (if applicable):

<= latest verison

How reproducible:

./imginfo -f POC1

Steps to Reproduce:

The output information is as follows:

$ ./imginfo -f POC1
imginfo: /home/icy/secreal/jasper/src/libjasper/jpc/jpc_t1cod.c:144: int JPC_NOMINALGAIN(int, int, int, int): Assertion `qmfbid == JPC_COX_RFT' failed.
Aborted (core dumped)

The gdb debugging information is listed below:
(gdb) set args POC1
(gdb) r 
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/icy/secreal/jasper/install/bin/imginfo -f  fuzz/output/crashes/id\:000001\,sig\:06\,src\:000004\,op\:flip1\,pos\:101

Breakpoint 1, JPC_NOMINALGAIN (qmfbid=129, numlvls=0, lvlno=0, orient=0)
    at /home/icy/secreal/jasper/src/libjasper/jpc/jpc_t1cod.c:144
144		assert(qmfbid == JPC_COX_RFT);
(gdb) n
imginfo: /home/icy/secreal/jasper/src/libjasper/jpc/jpc_t1cod.c:144: int JPC_NOMINALGAIN(int, int, int, int): Assertion `qmfbid == JPC_COX_RFT' failed.

Program received signal SIGABRT, Aborted.
0x00007ffff71f8428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
54	../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt 
#0  0x00007ffff71f8428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1  0x00007ffff71fa02a in __GI_abort () at abort.c:89
li#2  0x00007ffff71f0bd7 in __assert_fail_base (fmt=<optimized out>, 
    assertion=assertion@entry=0x7ffff7bc1c8d "qmfbid == JPC_COX_RFT", 
    file=file@entry=0x7ffff7bc1c40 "/home/icy/secreal/jasper/src/libjasper/jpc/jpc_t1cod.c", 
    line=line@entry=144, function=function@entry=0x7ffff7bc1ca3 "int JPC_NOMINALGAIN(int, int, int, int)")
    at assert.c:92
#3  0x00007ffff71f0c82 in __GI___assert_fail (assertion=0x7ffff7bc1c8d "qmfbid == JPC_COX_RFT", 
    file=0x7ffff7bc1c40 "/home/icy/secreal/jasper/src/libjasper/jpc/jpc_t1cod.c", line=144, 
    function=0x7ffff7bc1ca3 "int JPC_NOMINALGAIN(int, int, int, int)") at assert.c:101
#4  0x00007ffff7b81f45 in JPC_NOMINALGAIN (qmfbid=129, numlvls=0, lvlno=0, orient=0)
    at /home/icy/secreal/jasper/src/libjasper/jpc/jpc_t1cod.c:144st
#5  0x00007ffff7b43066 in jpc_dec_tileinit (dec=<optimized out>, tile=<optimized out>)
    at /home/icy/secreal/jasper/src/libjasper/jpc/jpc_dec.c:818
#6  jpc_dec_process_sod (dec=<optimized out>, ms=<optimized out>)
    at /home/icy/secreal/jasper/src/libjasper/jpc/jpc_dec.c:593
#7  0x00007ffff7b49ceb in jpc_dec_decode (dec=<optimized out>)
    at /home/icy/secreal/jasper/src/libjasper/jpc/jpc_dec.c:424
#8  jpc_decode (in=<optimized out>, optstr=<optimized out>)
    at /home/icy/secreal/jasper/src/libjasper/jpc/jpc_dec.c:261
---Type <return> to continue, or q <return> to quit---
#9  0x00007ffff7b059ce in jas_image_decode (in=<optimized out>, fmt=<optimized out>, optstr=<optimized out>)
    at /home/icy/secreal/jasper/src/libjasper/base/jas_image.c:442
#10 0x0000000000401bab in main (argc=<optimized out>, argv=<optimized out>)
    at /home/icy/secreal/jasper/src/appl/imginfo.c:238

Trigged in:
JPC_NOMINALGAIN (qmfbid=129, numlvls=0, lvlno=0, orient=0)
    at /home/icy/secreal/jasper/src/libjasper/jpc/jpc_t1cod.c:144
	...
139		numlvls = 0;
140	
141		if (qmfbid == JPC_COX_INS) {
142			return 0;
143		}
144		assert(qmfbid == JPC_COX_RFT);
145		if (lvlno == 0) {
146			assert(orient == JPC_TSFB_LL);
147			return 0;
148		} else {



Actual results:

crash

Expected results:

crash

Additional info:

Credits:

This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact ganshuitao   and chaoz.cn if you need more info about the team, the tool or the vulnerability.