Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 8 Jan 2016 02:46:06 +0300
From: Solar Designer <>
Subject: Fwd: Integer overflow in the JasPer's jas_matrix_create() function

The following message didn't make it to the list in time, getting stuck
in a temporary spam folder (so the moderators did not see it until I
just happened to find it in there today).

I've also re-attached the PoC that was attached to the original message.

Apparently, the issue was also reported on December 24 here:

The reason for the false spam detection turned out to be the Chinese
gb2312 charset.  We expect only English messages on most Openwall
mailing lists, so the following non-English charsets commonly seen in
spam arriving to our lists are currently treated as spam indicators:


These may or may not trigger spam detection depending on more factors,
which is why some other messages by the same sender made it through.

Unfortunately, this detection may sometimes be triggered on
mostly-English messages that have one of these charsets specified for
the message body (as it was in this case) or the message Subject.

For now, my advice is to avoid using these non-English charsets when
posting to English-only mailing lists.  We might reconsider the
anti-spam settings, although so far they've been reasonably effective
and such misdetection appears rare.

----- Forwarded message from limingxing <> -----

From: limingxing <>
To: "" <>
CC: ?????? <>
Subject: Integer overflow in the JasPer's jas_matrix_create() function
Date: Thu, 31 Dec 2015 02:05:38 +0000

We find a vulnerability in the way JasPer's jas_matrix_create() function parsed certain JPEG 2000 image files. 

jas_matrix_t *jas_matrix_create(int numrows, int numcols)

	if (matrix->maxrows_ > 0) {
		if (!(matrix->rows_ = jas_malloc(matrix->maxrows_ *
		  sizeof(jas_seqent_t *)))) {


matrix->maxrows_ > 0 ,but matrix->maxrows_ *sizeof(jas_seqent_t *) can cause Integer overflow.

Despite this library is used by many programs (, there is no one providing support.

This vulnerability was found by Qihoo 360 Codesafe Team

----- End forwarded message -----

Download attachment "poc.jp2" of type "application/octet-stream" (212 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.