Closed Cvjark closed 1 year ago
Both examples seem to point issue in libjpeg.so.8 (what was the exact version of libjpeg that jpegoptim was linked against?)
I use ldconfig -v | grep libjpeg
to checkout the version of libjpeg i use ,and the result : libjpeg.so.8 -> libjpeg.so.8.1.2
Was registered as CVE-2022-32325
How exactly is this an issue in jpegoptim?
Stack traces clearly show issue in libjpeg.so.8, and not in jpegoptim.... or am I missing something?
I would suggest to check and reproduce it with a newer "jpegoptim"
over updated "libjpeg"
.
Probably it's not an issue anymore. Also not sure if it's applicable to "libjpeg-turbo"
.
Unable to reproduce with the current 'master' branch (tested with currently latest libjpeg version "9e"):
$ ./jpegoptim -f --all-progressive 'crash1_SEGV_caused_by_READ_memory_access_at_jpegoptim.c^%631^%3'
crash1_SEGV_caused_by_READ_memory_access_at_jpegoptim.c^%631^%3 [ERROR]
$ ./jpegoptim -f --all-progressive 'crash_SEGV_caused_by_READ_memory_access_at_jpegoptim.c^%710^%18'
crash_SEGV_caused_by_READ_memory_access_at_jpegoptim.c^%710^%18 43x34 24bit P Exif IPTC XMP JFIF [OK] 8336 --> 8336 bytes (0.00%), optimized.
It could be that this was fixed by change 3401f250ace692a5b23eac1617dc429eb3566f9f.
Can you validate if you can still reproduce issue with the latest version from github?
hi, with the help of fuzzing ,I found some crash sample in this repo, here is the sample, are they new bugs?
crash position jpegoptim.c:631:3 crash sample: crash1_SEGV_caused_by_READ_memory_access_at_jpegoptim.c:631:3 sample here: crash1_SEGV_caused_by_READ_memory_access_at_jpegoptim.zip
command: ./jpegoptim -f --all-progressive crash_sample
crash position: jpegoptim.c:710:18 crash sample: crash2_SEGV_caused_by_READ_memory_access_at_jpegoptim.c:710:18 sample here: crash_SEGV_caused_by_READ_memory_access_at_jpegoptim.zip command: ./jpegoptim -f --all-progressive crash_sample