Vulnerability Note VU#887409

JasPer fails to properly decode marker segments and other sections in malformed JPEG2000 files. Malformed inputs can cause heap buffer overflows which in turn may result in execution of attacker-controlled code.

CVE-2011-4516: src/libjasper/jpc/jpc_cs.c: jpc_cox_getcompparms

jpc_cox_getcomparms is called as part of the decoding of a coding style default (COD) marker segment. The function populates a parameter struct (jpc_msparms_t) that is contained in a marker segment struct (jpc_ms_t). jpc_cox_getcompparms contains a loop that copies data from the input file to the jpc_msparms_t struct. The loop terminates on a value (numrlvls) derived from the input file:

for (i = 0; i < compparms->numrlvls; ++i) {
  if (jpc_getuint8(in, &tmp)) {
    jpc_cox_destroycompparms(compparms);
  return -1;
  }
  compparms->rlvls[i].parwidthval = tmp & 0xf;
  compparms->rlvls[i].parheightval = (tmp >> 4) & 0xf;
}

typedef struct {

  /* The type of marker segment. */
  uint_fast16_t id;

  /* The length of the marker segment. */
  uint_fast16_t len;

  /* The starting offset within the stream. */
  uint_fast32_t off;

  /* The parameters of the marker segment. */
  jpc_msparms_t parms;

  /* The marker segment operations. */
  struct jpc_msops_s *ops;

} jpc_ms_t;

jpc_crgcomp_t *comp;
...
if (!(crg->comps = jas_malloc(cstate->numcomps * sizeof(uint_fast16_t)))) {
  return -1;
}
...
for (compno = 0, comp = crg->comps; compno < cstate->numcomps;
++compno, ++comp) {
  if (jpc_getuint16(in, &comp->hoff) ||
    jpc_getuint16(in, &comp->voff)) {
    jpc_crg_destroyparms(ms);
    return -1;
  }
}

By tricking a user into opening or previewing an image file in an application that decodes images with the JasPer library, an attacker can execute arbitrary code or cause a denial-of-service crash.

Apply an update

Users who obtain JasPer from a third-party vendor, such as their operating system vendor, should see the vendor information portion of this document for a partial list of affected vendors.

Please consider the following workarounds:

Avoid processing malicious image files

Turn off image preview features in file browsers and other applications that use the JasPer library. Avoid opening image attachments from untrusted or unrecognized sources.