Created attachment 1318062 [details]
Triggered by  "./imginfo -f POC3"

Description of problem:

There is a reachable assertion abort in function jpc_dequantize() of JasPer that will lead to remote denial of service attack.

Version-Release number of selected component (if applicable):

<= latest version

How reproducible:

./imginfo -f POC3

Steps to Reproduce:

The output information is as follows:

$ ./imginfo -f POC3
type = 0xff76 (UNKNOWN); len = 20;10 40 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 imginfo: /home/icy/secreal/jasper/src/libjasper/jpc/jpc_dec.c:1883: void jpc_dequantize(jas_matrix_t *, jpc_fix_t): Assertion `absstepsize >= 0' failed.
Aborted (core dumped)


The gdb debugging information is listed below:
(gdb) set args POC3
(gdb) r 
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/icy/secreal/jasper/install/bin/imginfo -f fuzz/output/crashes/id\:000137\,sig\:06\,src\:000444\,op\:flip4\,pos\:127  
s warning: ignoring unknown marker segment (0xff76)
type = 0xff76 (UNKNOWN); len = 20;10 40 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
Breakpoint 3, jpc_dec_tiledecode (dec=<optimized out>, tile=<optimized out>)
    at /home/icy/secreal/jasper/src/libjasper/jpc/jpc_dec.c:1107
1107						jpc_dequantize(band->data, band->absstepsize);
(gdb) s 
jpc_dequantize (x=<optimized out>, absstepsize=-9223372036854775808)
    at /home/icy/secreal/jasper/src/libjasper/jpc/jpc_dec.c:1883
1883		assert(absstepsize >= 0);
(gdb) bt 
#0  jpc_dequantize (x=<optimized out>, absstepsize=-9223372036854775808)
    at /home/icy/secreal/jasper/src/libjasper/jpc/jpc_dec.c:1883
#1  jpc_dec_tiledecode (dec=<optimized out>, tile=<optimized out>)
    at /home/icy/secreal/jasper/src/libjasper/jpc/jpc_dec.c:1107
#2  0x00007ffff7b4535b in jpc_dec_process_sod (dec=<optimized out>, ms=<optimized out>)
    at /home/icy/secreal/jasper/src/libjasper/jpc/jpc_dec.c:657
#3  0x00007ffff7b49ceb in jpc_dec_decode (dec=<optimized out>)
    at /home/icy/secreal/jasper/src/libjasper/jpc/jpc_dec.c:424
#4  jpc_decode (in=<optimized out>, optstr=<optimized out>)
    at /home/icy/secreal/jasper/src/libjasper/jpc/jpc_dec.c:261
#5  0x00007ffff7b2d030 in jp2_decode (in=<optimized out>, optstr=<optimized out>)
    at /home/icy/secreal/jasper/src/libjasper/jp2/jp2_dec.c:218
#6  0x00007ffff7b059ce in jas_image_decode (in=<optimized out>, fmt=<optimized out>, optstr=<optimized out>)
    at /home/icy/secreal/jasper/src/libjasper/base/jas_image.c:442
#7  0x0000000000401bab in main (argc=<optimized out>, argv=<optimized out>)
    at /home/icy/secreal/jasper/src/appl/imginfo.c:238

(gdb) n
imginfo: /home/icy/secreal/jasper/src/libjasper/jpc/jpc_dec.c:1883: void jpc_dequantize(jas_matrix_t *, jpc_fix_t): Assertion `absstepsize >= 0' failed.

Program received signal SIGABRT, Aborted.
0x00007ffff71f8428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
54	../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) 


jpc_dequantize (x=<optimized out>, absstepsize=-9223372036854775808)
    at /home/icy/secreal/jasper/src/libjasper/jpc/jpc_dec.c:1883
1883		assert(absstepsize >= 0);
(gdb) list 
1878	{
1879		int i;
1880		int j;
1881		int t;
1882	
1883		assert(absstepsize >= 0);
1884		if (absstepsize == jpc_inttofix(1)) {
1885			return;
1886		}
1887	

Actual results:

crash

Expected results:

crash

Additional info:

Credits:

This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact ganshuitao   and chaoz.cn if you need more info about the team, the tool or the vulnerability.