Heap buffer overflow to out of bounds write in the jpc encoder's cp_create() routine when resolution levels are greater than max.
Created jasper tracking bugs for this issue:
Affects: fedora-all [bug 1905202]
Created mingw-jasper tracking bugs for this issue:
Affects: fedora-all [bug 1905203]
It's possible that an image processed by jasper along with crafted rlvl input could set resolution levels above max, which could cause a heap buffer overflow in the loop near `tccp->prcwidthexpns[rlvlno] = prcwidthexpn;` in the `cp_create()` routine of /src/libjasper/jpc/jpc_enc.c. Because `prcwidthexpn` and `prcheightexpn` can also be controlled by data obtained from the crafted input, it leaves potential for exploitation surrounding arbitrary writes.
The above flaw is mostly caused by improper input validation where the provided rlvl value is trusted by default.
This flaw can be mitigated for the Jasper tool by not accepting untrusted inputs to be processed by Jasper or constraining rlevels on those inputs from outside of Jasper.