gcode-importer
commented
10 years ago Dear OpenJpeg developers,
we identified two heap overflow vulnerabilities in OpenJpeg 1.5.2. Attached to this
message there are two proof of concept images which will help you confirm and address
the vulnerabilities.
Please confirm at your earliest convenience that you have received this vulnerability
report. We will gladly work with you so you can successfully confirm and reproduce
this issue.
Also note that this bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically become visible
to the public.
We’ll be tracking this on:
https://code.google.com/p/google-security-research/issues/detail?id=105
Don’t hesitate to let us know if you have any questions!
Details
For both bugs I used j2k_dump from the precompiled 32-bit package that can be downloaded
from Sourceforge (http://sourceforge.net/projects/openjpeg.mirror/files/1.5.2/openjpeg-1.5.2-Linux-i386.tar.gz/download).
Heap Overflow in dwt_interleave_h
The bug is triggered in case that h->sn in dwt_interleave_h() receives a dwt_t object
with a negative value in the sn field, causing the “while(--i)” loop to overflow h->mem:
static void dwt_interleave_h(dwt_t* h, int *a) {
int *ai = a;
int *bi = h->mem + h->cas;
int i = h->sn;
printf("i: %d\n", i);
while( i-- ) {
*bi = *(ai++);
bi += 2;
}
Taking a look inside gdb:
$ r -i dwt_interleave_h.jp2
Program received signal SIGSEGV, Segmentation fault.
[--------------registers--------------]
EAX: 0x2454 ('T$')
EBX: 0xf7fd8124 --> 0x2300c
ECX: 0x31ff36ff
EDX: 0x810ad60 --> 0xffffffcc
ESI: 0x810b900 --> 0x0
EDI: 0x0
EBP: 0xffffffff
ESP: 0xffff9800 --> 0xf7fba539 (<dwt_decode+153>: mov edi,DWORD PTR [esp+0x38])
EIP: 0xf7fba5fb (<dwt_decode+347>: mov DWORD PTR [edx+eax*8],ecx)
EFLAGS: 0x10217 (CARRY PARITY ADJUST zero sign trap INTERRUPT direction overflow)
[--------------code--------------]
0xf7fba5f2 <dwt_decode+338>: mov DWORD PTR [esp+0x20],ecx
0xf7fba5f6 <dwt_decode+342>: xchg ax,ax
0xf7fba5f8 <dwt_decode+344>: mov ecx,DWORD PTR [esi+eax*4]
=> 0xf7fba5fb <dwt_decode+347>: mov DWORD PTR [edx+eax*8],ecx
0xf7fba5fe <dwt_decode+350>: add eax,0x1
0xf7fba601 <dwt_decode+353>: cmp eax,ebp
0xf7fba603 <dwt_decode+355>: jne 0xf7fba5f8 <dwt_decode+344>
0xf7fba605 <dwt_decode+357>: mov ecx,DWORD PTR [esp+0x20]
Stopped reason: SIGSEGV
0xf7fba5fb in dwt_interleave_h (a=0x810b900, h=0xffff9840) at /tmp/openjpeg_release/openjpeg/libopenjpeg/dwt.c:187
187 in /tmp/openjpeg_release/openjpeg/libopenjpeg/dwt.c
$ bt
#0 0xf7fba5fb in dwt_interleave_h (a=0x810b900, h=0xffff9840) at /tmp/openjpeg_release/openjpeg/libopenjpeg/dwt.c:187
#1 dwt_decode_tile (numres=<optimized out>, tilec=0x81019b8, dwt_1D=<optimized out>)
at /tmp/openjpeg_release/openjpeg/libopenjpeg/dwt.c:548
#2 dwt_decode (tilec=0x81019b8, numres=0x1d, numres@entry=0x1f) at /tmp/openjpeg_release/openjpeg/libopenjpeg/dwt.c:383
#3 0xf7fcff45 in tcd_decode_tile (tcd=tcd@entry=0x8101618, src=0x8100f58, len=0x6ba,
tileno=0x0, cstr_info=0x0) at /tmp/openjpeg_release/openjpeg/libopenjpeg/tcd.c:1444
#4 0xf7fbcd1b in j2k_read_eoc (j2k=0x80fc088) at /tmp/openjpeg_release/openjpeg/libopenjpeg/j2k.c:1695
#5 0xf7fbe0a9 in j2k_decode (j2k=0x80fc088, cio=cio@entry=0x80fc150, cstr_info=cstr_info@entry=0x0)
at /tmp/openjpeg_release/openjpeg/libopenjpeg/j2k.c:2027
#6 0xf7fc0f6a in opj_jp2_decode (jp2=0x80fc028, cio=cio@entry=0x80fc150, cstr_info=cstr_info@entry=0x0)
at /tmp/openjpeg_release/openjpeg/libopenjpeg/jp2.c:841
#7 0xf7fc3987 in opj_decode_with_info (dinfo=dinfo@entry=0x80fc008, cio=cio@entry=0x80fc150,
cstr_info=cstr_info@entry=0x0) at /tmp/openjpeg_release/openjpeg/libopenjpeg/openjpeg.c:168
#8 0xf7fc39eb in opj_decode (dinfo=dinfo@entry=0x80fc008, cio=cio@entry=0x80fc150)
at /tmp/openjpeg_release/openjpeg/libopenjpeg/openjpeg.c:157
#9 0x080550e0 in main (argc=0x3, argv=0xffffcc74) at /tmp/openjpeg_release/openjpeg/applications/codec/j2k_dump.c:507
#10 0xf7daea83 in __libc_start_main () from /lib/i386-linux-gnu/libc.so.6
#11 0x08055389 in _start ()
$ info proc mappings
process 21130
Mapped address spaces:
Start Addr End Addr Size Offset objfile
[...]
0x80fc000 0x811d000 0x21000 0x0 [heap]
0xf7d94000 0xf7d95000 0x1000 0x0
[...]
“mov DWORD PTR [edx+eax*8],ecx” is writing past the end of the heap in 0x811d000
Heap Overflow in dwt_decode_real/v4dwt_interleave_h
The bug is in v4dwt_interleave_h() where we have some control over the w->sn value
and can therefore overflow w->wavelet.
static void v4dwt_interleave_h(v4dwt_t* restrict w, float* restrict a, int x, int size){
float* restrict bi = (float*) (w->wavelet + w->cas);
int count = w->sn;
[...]
/* Slow code path */
for(i = 0; i < count; ++i){
int j = i;
bi[i*8 ] = a[j];
j += x;
if(j > size) continue;
bi[i*8 + 1] = a[j];
j += x;
if(j > size) continue;
bi[i*8 + 2] = a[j];
j += x;
if(j > size) continue;
bi[i*8 + 3] = a[j];
}
With the attached proof of concept, the wavelet is allocated with 105 elements (1680
bytes) but we can specify a count equal to 100 via w->sn, which allows us to overwrite
up to the position 803.
The overflow happens right after the alloc, so we’re not overwriting other objects
on the heap at this point. This causes a less obvious crash that with the previous
bug, so it’s better to take a look with valgrind:
$ valgrind ./j2k_dump -i v4dwt_interleave_h.j2k
[...]
[INFO] tile 1 of 1
[INFO] - tiers-1 took 0.056034 s
==19760== Invalid write of size 4
==19760== at 0x403BDCD: v4dwt_interleave_h (/tmp/openjpeg_release/openjpeg/libopenjpeg/dwt.c:589)
==19760== by 0x403D012: dwt_decode_real (/tmp/openjpeg_release/openjpeg/libopenjpeg/dwt.c:821)
==19760== by 0x4051EE0: tcd_decode_tile (/tmp/openjpeg_release/openjpeg/libopenjpeg/tcd.c:1446)
==19760== by 0x403ED1A: j2k_read_eoc (/tmp/openjpeg_release/openjpeg/libopenjpeg/j2k.c:1695)
==19760== by 0x40400A8: j2k_decode (/tmp/openjpeg_release/openjpeg/libopenjpeg/j2k.c:2027)
==19760== by 0x4045966: opj_decode_with_info (/tmp/openjpeg_release/openjpeg/libopenjpeg/openjpeg.c:164)
==19760== by 0x40E3A82: (below main) (in /lib/i386-linux-gnu/libc-2.19.so)
==19760== Address 0x42a53f0 is 16 bytes after a block of size 1,680 alloc'd
==19760== at 0x402BC74: memalign (valgrind/coregrind/m_replacemalloc/vg_replace_malloc.c:726)
==19760== by 0x403CD19: dwt_decode_real (/tmp/openjpeg_release/openjpeg/libopenjpeg/dwt.c:786)
==19760== by 0x4051EE0: tcd_decode_tile (/tmp/openjpeg_release/openjpeg/libopenjpeg/tcd.c:1446)
==19760== by 0x403ED1A: j2k_read_eoc (/tmp/openjpeg_release/openjpeg/libopenjpeg/j2k.c:1695)
==19760== by 0x40400A8: j2k_decode (/tmp/openjpeg_release/openjpeg/libopenjpeg/j2k.c:2027)
==19760== by 0x4045966: opj_decode_with_info (/tmp/openjpeg_release/openjpeg/libopenjpeg/openjpeg.c:164)
==19760== by 0x40E3A82: (below main) (in /lib/i386-linux-gnu/libc-2.19.so)
Reported by detonin on 2014-09-15 12:53:44
- _Attachment: openjpeg_1.5.2_PoC.tgz_
mayeut
Originally reported on Google Code with ID 388
Reported by detonin on 2014-09-15 12:45:50