Created attachment 18885 [details] trigger a buffer overflow in the DHT marker handler. dsjpeg can be tricked into overflowing its internal Huffman table arrays. Valgrind says of the attached test case: ==31295== Copyright (C) 2004-2006, and GNU GPL'd, by OpenWorks LLP. ==31295== Using valgrind-3.2.1-Debian, a dynamic binary instrumentation framework. ==31295== Copyright (C) 2000-2006, and GNU GPL'd, by Julian Seward et al. ==31295== For more details, rerun with: -v ==31295== ==31295== Invalid write of size 1 ==31295== at 0x40382C: huffman_table_add (jpeg_huffman.c:48) ==31295== by 0x401B59: huffman_table_init_jpeg (jpeg.c:273) ==31295== by 0x402B8C: jpeg_decoder_define_huffman_tables (jpeg.c:751) ==31295== by 0x4028D9: jpeg_decoder_decode (jpeg.c:672) ==31295== by 0x403C24: jpeg_decode_argb (jpeg_rgb_decoder.c:58) ==31295== by 0x400DB0: main (load.c:46) ==31295== Address 0x537B434 is 12 bytes after a block of size 43,984 alloc'd ==31295== at 0x4A1B858: malloc (vg_replace_malloc.c:149) ==31295== by 0x40245F: jpeg_decoder_new (jpeg.c:535) ==31295== by 0x403C07: jpeg_decode_argb (jpeg_rgb_decoder.c:55) ==31295== by 0x400DB0: main (load.c:46) ==31295== ==31295== Invalid write of size 4 ==31295== at 0x403844: huffman_table_add (jpeg_huffman.c:49) ==31295== by 0x401B59: huffman_table_init_jpeg (jpeg.c:273) [snip] When run without valgrind this test case causes glibc to abort on x86-64: *** glibc detected *** free(): invalid pointer: 0x0000000000512f40 *** error: decoder error: bad huffsize[] arrayAborted On x86-32 the test causes dsjpeg to error out with a message "bad huffsize[] array" seemingly intact, but note that the bug isn't 64 bit specific.
Adjusted the severity. I think the fastest we switch to ijg jpeg the better.
Created attachment 19067 [details] [review] don't overflow huffmantable entries array This fix the issue for me, thanks Joonas for sharing the fun ;)
Created attachment 19069 [details] [review] missing free for error_message Noticed while testing the patch, the buffer used for reporting the error message was never freed.
fixed in git master (and soon) 0.8
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.