Bug 697934 - Jbig2dec latest version, as used in MuPDF and Ghostscript, has a NULL pointer dereference in the jbig2_huffman_get function in jbig2_huffman.c. For example, the jbig2dec utility will crash (segmentation fault) when parsing an invalid file.
Summary: Jbig2dec latest version, as used in MuPDF and Ghostscript, has a NULL pointer...
Status: RESOLVED FIXED
Alias: None
Product: jbig2dec
Classification: Unclassified
Component: Parsing (show other bugs)
Version: master
Hardware: PC Linux
: P1 normal
Assignee: Henry Stiles
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-05-23 18:55 UTC by Young_X
Modified: 2017-05-27 12:00 UTC (History)
2 users (show)

See Also:
Customer:
Word Size: ---

Attachments
analysis (1.36 MB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2017-05-23 18:58 UTC, Young_X 		Details
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Young_X 2017-05-23 18:55:02 UTC 
Created attachment 13710 [details]
crash file

#Description
Jbig2dec latest version, as used in MuPDF and Ghostscript, has a NULL pointer dereference in the jbig2_huffman_get function in jbig2_huffman.c. For example, the jbig2dec utility will crash (segmentation fault) when parsing an invalid file.


#Error info
Starting program: /home/mayfeel/fuzz/jbig2dec/jbig2dec ../crash/crash0000
jbig2dec FATAL ERROR missing glyph 0/0! (segment 0x01)

Program received signal SIGSEGV, Segmentation fault.
jbig2_huffman_get (hs=hs@entry=0x651370, table=0x0, oob=oob@entry=0x7fffffffc970) at jbig2_huffman.c:274
274	        int log_table_size = table->log_table_size;
(gdb) p table
$1 = (const Jbig2HuffmanTable *) 0x0
(gdb) bt
#0  jbig2_huffman_get (hs=hs@entry=0x651370, table=0x0, oob=oob@entry=0x7fffffffc970) at jbig2_huffman.c:274
#1  0x0000000000408092 in jbig2_decode_text_region (ctx=ctx@entry=0x619240, segment=segment@entry=0x626da0, params=params@entry=0x627120, dicts=dicts@entry=0x626fd0, n_dicts=n_dicts@entry=1, 
    image=image@entry=0x651320, data=0x61a474 "\336\177\001", size=34, GR_stats=0x64f2c0 "", as=0x626e00, ws=0x626de0) at jbig2_text.c:340
#2  0x0000000000405e87 in jbig2_decode_symbol_dict (GR_stats=<optimized out>, GB_stats=<optimized out>, size=<optimized out>, data=<optimized out>, params=0x7fffffffcce0, segment=0x626da0, ctx=0x619240)
    at jbig2_symbol_dict.c:496
#3  jbig2_symbol_dictionary (ctx=ctx@entry=0x619240, segment=segment@entry=0x626da0, segment_data=<optimized out>) at jbig2_symbol_dict.c:996
#4  0x0000000000404530 in jbig2_parse_segment (ctx=ctx@entry=0x619240, segment=segment@entry=0x626da0, segment_data=<optimized out>) at jbig2_segment.c:234
#5  0x0000000000403a21 in jbig2_data_in (ctx=ctx@entry=0x619240, data=data@entry=0x7fffffffce60 "\227JB2\r\n\032\n\001", size=<optimized out>) at jbig2.c:312
#6  0x0000000000401697 in main (argc=<optimized out>, argv=0x7fffffffdf88) at jbig2dec.c:456

#Analysis
See attachment
Comment 1 Young_X 2017-05-23 18:58:57 UTC 
Created attachment 13711 [details]
analysis