Closed
Description
On master:
# opj_compress -r 20,10,1 -jpip -EPH -SOP -cinema2K 24 -n 1 -i $FILE -o null.j2k
TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.
TIFFReadDirectory: Warning, Unknown field with tag 65535 (0xffff) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 8448 (0x2100) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 769 (0x301) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 65280 (0xff00) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 18758 (0x4946) encountered.
_TIFFVSetField: 1.crashes.tif: Null count for "Tag 8448" (type 1, writecount -3, passcount 1).
TIFFReadDirectory: Warning, TIFF directory is missing required "StripByteCounts" field, calculating from imagelength.
=================================================================
==69807==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6120000002d4 at pc 0x0000004bace8 bp 0x7ffeaee98820 sp 0x7ffeaee97fd0
WRITE of size 2 at 0x6120000002d4 thread T0
#0 0x4bace7 in __asan_memcpy /var/tmp/portage/sys-libs/compiler-rt-sanitizers-4.0.1/work/compiler-rt-4.0.1.src/lib/asan/asan_interceptors.cc:453
#1 0x7fed24f29699 in opj_t2_encode_packet /var/tmp/portage/media-libs/openjpeg-9999/work/openjpeg-9999/src/lib/openjp2/t2.c:868:13
#2 0x7fed24f25d8a in opj_t2_encode_packets /var/tmp/portage/media-libs/openjpeg-9999/work/openjpeg-9999/src/lib/openjp2/t2.c:275:31
#3 0x7fed24f34f71 in opj_tcd_rateallocate /var/tmp/portage/media-libs/openjpeg-9999/work/openjpeg-9999/src/lib/openjp2/tcd.c:597:27
#4 0x7fed24f3ed8d in opj_tcd_rate_allocate_encode /var/tmp/portage/media-libs/openjpeg-9999/work/openjpeg-9999/src/lib/openjp2/tcd.c:2259:15
#5 0x7fed24f3ed8d in opj_tcd_encode_tile /var/tmp/portage/media-libs/openjpeg-9999/work/openjpeg-9999/src/lib/openjp2/tcd.c:1375
#6 0x7fed24e5b8a4 in opj_j2k_write_sod /var/tmp/portage/media-libs/openjpeg-9999/work/openjpeg-9999/src/lib/openjp2/j2k.c:4661:11
#7 0x7fed24e5b8a4 in opj_j2k_write_first_tile_part /var/tmp/portage/media-libs/openjpeg-9999/work/openjpeg-9999/src/lib/openjp2/j2k.c:11521
#8 0x7fed24e5b8a4 in opj_j2k_post_write_tile /var/tmp/portage/media-libs/openjpeg-9999/work/openjpeg-9999/src/lib/openjp2/j2k.c:11279
#9 0x7fed24e5a45d in opj_j2k_encode /var/tmp/portage/media-libs/openjpeg-9999/work/openjpeg-9999/src/lib/openjp2/j2k.c:11028:15
#10 0x7fed24ea52f8 in opj_encode /var/tmp/portage/media-libs/openjpeg-9999/work/openjpeg-9999/src/lib/openjp2/openjpeg.c:775:20
#11 0x50b942 in main /var/tmp/portage/media-libs/openjpeg-9999/work/openjpeg-9999/src/bin/jp2/opj_compress.c:1993:36
#12 0x7fed2383c680 in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.23-r4/work/glibc-2.23/csu/../csu/libc-start.c:289
#13 0x41bc18 in _start (/usr/bin/opj_compress+0x41bc18)
0x6120000002d4 is located 0 bytes to the right of 276-byte region [0x6120000001c0,0x6120000002d4)
allocated by thread T0 here:
#0 0x4d15c8 in malloc /var/tmp/portage/sys-libs/compiler-rt-sanitizers-4.0.1/work/compiler-rt-4.0.1.src/lib/asan/asan_malloc_linux.cc:66
#1 0x7fed24f50e29 in opj_malloc /var/tmp/portage/media-libs/openjpeg-9999/work/openjpeg-9999/src/lib/openjp2/opj_malloc.c:196:12
#2 0x7fed24e87760 in opj_j2k_update_rates /var/tmp/portage/media-libs/openjpeg-9999/work/openjpeg-9999/src/lib/openjp2/j2k.c:5157:22
#3 0x7fed24e5e37f in opj_j2k_exec /var/tmp/portage/media-libs/openjpeg-9999/work/openjpeg-9999/src/lib/openjp2/j2k.c:7954:33
#4 0x7fed24e5e37f in opj_j2k_start_compress /var/tmp/portage/media-libs/openjpeg-9999/work/openjpeg-9999/src/lib/openjp2/j2k.c:11103
#5 0x7fed24ea519c in opj_start_compress /var/tmp/portage/media-libs/openjpeg-9999/work/openjpeg-9999/src/lib/openjp2/openjpeg.c:758:20
#6 0x50b90f in main /var/tmp/portage/media-libs/openjpeg-9999/work/openjpeg-9999/src/bin/jp2/opj_compress.c:1970:20
#7 0x7fed2383c680 in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.23-r4/work/glibc-2.23/csu/../csu/libc-start.c:289
SUMMARY: AddressSanitizer: heap-buffer-overflow /var/tmp/portage/sys-libs/compiler-rt-sanitizers-4.0.1/work/compiler-rt-4.0.1.src/lib/asan/asan_interceptors.cc:453 in __asan_memcpy
Shadow bytes around the buggy address:
0x0c247fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c247fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c247fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c247fff8030: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c247fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c247fff8050: 00 00 00 00 00 00 00 00 00 00[04]fa fa fa fa fa
0x0c247fff8060: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c247fff8070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c247fff8080: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
0x0c247fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c247fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==69807==ABORTING
CINEMA 2K profile activated
Other options specified could be overridden
[WARNING] JPEG 2000 Profile-3 and 4 (2k/4k dc profile) requires:
1 single quality layer-> Number of layers forced to 1 (rather than 3)
-> Rate of the last layer (1.0) will be used[WARNING] JPEG 2000 Profile-3 (2k dc profile) requires:
3 components-> Number of components of input image (1) is not compliant
-> Non-profile-3 codestream will be generated
[INFO] tile number 1 / 1
Testcase:
https://github.com/asarubbo/poc/blob/master/00323-openjpeg-heapoverflow-opj_t2_encode_packet
Metadata
Assignees
Labels
No labels