Created attachment 1318058 [details]
Triggered by  "./imginfo -f POC2"

Description of problem:

There is a reachable assertion abort in function jpc_dec_process_sot() of JasPer that will lead to remote denial of service attack.


Version-Release number of selected component (if applicable):

<= latest version

How reproducible:

./imginfo -f POC2


Steps to Reproduce:

$ ./imginfo -f POC2
Aborted (core dumped)

The gdb debugging information is listed below:
(gdb) set args POC2
(gdb) r 
...

Breakpoint 2, jpc_dec_process_sot (dec=<optimized out>, ms=<optimized out>)
    at /home/icy/secreal/jasper/src/libjasper/jpc/jpc_dec.c:515
515					abort();
(gdb) list 
510			  the main header? */
511			if (dec->ppmstab) {
512				/* Convert the PPM marker segment data into a collection of streams
513				  (one stream per tile-part). */
514				if (!(dec->pkthdrstreams = jpc_ppmstabtostreams(dec->ppmstab))) {
515					abort();
516				}
517				jpc_ppxstab_destroy(dec->ppmstab);
518				dec->ppmstab = 0;
519			}
(gdb) bt
#0  jpc_dec_process_sot (dec=<optimized out>, ms=<optimized out>)
    at /home/icy/secreal/jasper/src/libjasper/jpc/jpc_dec.c:515
#1  0x00007ffff7b49ceb in jpc_dec_decode (dec=<optimized out>)
    at /home/icy/secreal/jasper/src/libjasper/jpc/jpc_dec.c:424
#2  jpc_decode (in=<optimized out>, optstr=<optimized out>)
    at /home/icy/secreal/jasper/src/libjasper/jpc/jpc_dec.c:261
#3  0x00007ffff7b059ce in jas_image_decode (in=<optimized out>, fmt=<optimized out>, optstr=<optimized out>)
    at /home/icy/secreal/jasper/src/libjasper/base/jas_image.c:442
#4  0x0000000000401bab in main (argc=<optimized out>, argv=<optimized out>)
    at /home/icy/secreal/jasper/src/appl/imginfo.c:238

Program received signal SIGABRT, Aborted.
0x00007ffff71f8428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
54	../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) 

jpc_dec_process_sot (dec=<optimized out>, ms=<optimized out>)
    at /home/icy/secreal/jasper/src/libjasper/jpc/jpc_dec.c:515
510			  the main header? */
511			if (dec->ppmstab) {
512				/* Convert the PPM marker segment data into a collection of streams
513				  (one stream per tile-part). */
514				if (!(dec->pkthdrstreams = jpc_ppmstabtostreams(dec->ppmstab))) {
515					abort();
516				}
517				jpc_ppxstab_destroy(dec->ppmstab);
518				dec->ppmstab = 0;
519			}


Actual results:

crash

Expected results:

crash

Additional info:


Credits:

This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact ganshuitao   and chaoz.cn if you need more info about the team, the tool or the vulnerability.