Bug 696052 - Segfault (null pointer access) when trying to open malformed inputs
Summary: Segfault (null pointer access) when trying to open malformed inputs
Status: RESOLVED FIXED
Alias: None
Product: jbig2dec
Classification: Unclassified
Component: Parsing (show other bugs)
Version: unspecified
Hardware: PC Linux
: P4 normal
Assignee: Henry Stiles
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-06-25 02:43 UTC by hanno
Modified: 2015-12-12 09:48 UTC (History)
1 user (show)

See Also:
Customer:
Word Size: ---

Attachments
crashing input sample (68 bytes, application/octet-stream)
2015-06-25 02:43 UTC, hanno 		Details
crashing input sample 2 (43 bytes, application/octet-stream)
2015-06-25 02:43 UTC, hanno 		Details
Patch to check for missing image (614 bytes, patch)
2015-09-03 14:48 UTC, Shailesh Mistry 		Details | Diff
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description hanno 2015-06-25 02:43:10 UTC 
Created attachment 11757 [details]
crashing input sample

The attached files will cause a null pointer access / segfault in jbig2dec. Both have slightly different stack traces, but look similar.

Address Sanitizer stack traces:
==6967==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000004 (pc 0x00000051c067 bp 0x000000000001 sp 0x7fff3bb8ff10 T0)
    #0 0x51c066 in jbig2_image_get_pixel /f/jbig2dec/jbig2dec-0.12/jbig2_image.c:328:17
    #1 0x508e4b in jbig2_decode_refinement_template1_unopt /f/jbig2dec/jbig2dec-0.12/jbig2_refinement.c:134:18
    #2 0x508e4b in jbig2_decode_refinement_region /f/jbig2dec/jbig2dec-0.12/jbig2_refinement.c:391
    #3 0x50a993 in jbig2_refinement_region /f/jbig2dec/jbig2dec-0.12/jbig2_refinement.c:558:12
    #4 0x4eba5b in jbig2_parse_segment /f/jbig2dec/jbig2dec-0.12/jbig2_segment.c:280:14
    #5 0x4e81fa in jbig2_data_in /f/jbig2dec/jbig2dec-0.12/jbig2.c:364:11
    #6 0x4dee17 in main /f/jbig2dec/jbig2dec-0.12/jbig2dec.c:454:11
    #7 0x7f8c84569f9f in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.20-r2/work/glibc-2.20/csu/libc-start.c:289
    #8 0x437e56 in _start (/mnt/ram/jb2/jbig2dec+0x437e56)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /f/jbig2dec/jbig2dec-0.12/jbig2_image.c:328 jbig2_image_get_pixel
==6967==ABORTING


==29123==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000004 (pc 0x00000051c067 bp 0x000000000000 sp 0x7fff5a2e2010 T0)
    #0 0x51c066 in jbig2_image_get_pixel /f/jbig2dec/jbig2dec-0.12/jbig2_image.c:328:17
    #1 0x509290 in jbig2_decode_refinement_template0_unopt /f/jbig2dec/jbig2dec-0.12/jbig2_refinement.c:78:18
    #2 0x509290 in jbig2_decode_refinement_region /f/jbig2dec/jbig2dec-0.12/jbig2_refinement.c:394
    #3 0x50a993 in jbig2_refinement_region /f/jbig2dec/jbig2dec-0.12/jbig2_refinement.c:558:12
    #4 0x4eba5b in jbig2_parse_segment /f/jbig2dec/jbig2dec-0.12/jbig2_segment.c:280:14
    #5 0x4e81fa in jbig2_data_in /f/jbig2dec/jbig2dec-0.12/jbig2.c:364:11
    #6 0x4dee17 in main /f/jbig2dec/jbig2dec-0.12/jbig2dec.c:454:11
    #7 0x7efe8c774f9f in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.20-r2/work/glibc-2.20/csu/libc-start.c:289
    #8 0x437e56 in _start (/mnt/ram/jb2/jbig2dec+0x437e56)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /f/jbig2dec/jbig2dec-0.12/jbig2_image.c:328 jbig2_image_get_pixel
==29123==ABORTING
Comment 1 hanno 2015-06-25 02:43:36 UTC 
Created attachment 11758 [details]
crashing input sample 2
Comment 2 Shailesh Mistry 2015-09-03 14:48:24 UTC 
Created attachment 11885 [details]
Patch to check for missing image

The attached sample images try to access an image that does not exist. This patch checks that the cloned image exists before proceeding further.