oss-security - Re: Re: Integer overflow in the JasPer's jas_matrix

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 11 Jan 2016 14:03:35 +0100
From: Stefan Cornelius <scorneli@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: Integer overflow in the JasPer's
 jas_matrix_create() function

On Thu,  7 Jan 2016 21:41:57 -0500 (EST)
cve-assign@...re.org wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
> 
> >> https://bugzilla.redhat.com/show_bug.cgi?id=1294039  
> 
> > We find a vulnerability in the way JasPer's jas_matrix_create()
> > function parsed certain JPEG 2000 image files.
> > 
> > jas_matrix_t *jas_matrix_create(int numrows, int numcols)
> > {
> >         .......
> > 
> >         if (matrix->maxrows_ > 0) {
> >                 if (!(matrix->rows_ = jas_malloc(matrix->maxrows_ *
> >                   sizeof(jas_seqent_t *)))) {
> >   
> 
> > matrix->maxrows_ > 0 ,but matrix->maxrows_ *sizeof(jas_seqent_t *)
> > can cause Integer overflow.
> > 
> > Despite this library is used by many programs
> > (http://www.ece.uvic.ca/~frodo/jasper/#overview), there is no one
> > providing support.  
> 
> Use CVE-2015-8751.
> 

Hi,

Just a quick heads-up: We at Red Hat originally fixed this as part of
the patch for CVE-2008-3520. This was a rather big patch and
closed a lot of potential integer overflows (originally from
OpenBSD?). I imagine a lot of distros used the same patch.

The original description for CVE-2008-3520 is quite general, so I'm
not sure if that's enough to say that CVE-2015-8751 is a dupe or not.

-- 
Stefan Cornelius / Red Hat Product Security

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.