Heap buffer overflow to out of bounds write in the jpc encoder's cp_create() routine when resolution levels are greater than max. Reference: https://github.com/jasper-software/jasper/issues/252 Upstream patch: https://github.com/jasper-software/jasper/pull/253
Created jasper tracking bugs for this issue: Affects: fedora-all [bug 1905202] Created mingw-jasper tracking bugs for this issue: Affects: fedora-all [bug 1905203]
Flaw summary: It's possible that an image processed by jasper along with crafted rlvl input could set resolution levels above max, which could cause a heap buffer overflow in the loop near `tccp->prcwidthexpns[rlvlno] = prcwidthexpn;` in the `cp_create()` routine of /src/libjasper/jpc/jpc_enc.c. Because `prcwidthexpn` and `prcheightexpn` can also be controlled by data obtained from the crafted input, it leaves potential for exploitation surrounding arbitrary writes.
The above flaw is mostly caused by improper input validation where the provided rlvl value is trusted by default.
Upstream commit: https://github.com/jasper-software/jasper/commit/4cd52b5daac62b00a0a328451544807ddecf775f
Acknowledgments: Name: zodf0055980
Mitigation: This flaw can be mitigated for the Jasper tool by not accepting untrusted inputs to be processed by Jasper or constraining rlevels on those inputs from outside of Jasper.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:4235 https://access.redhat.com/errata/RHSA-2021:4235