decode: out of bounds buffer access about openjph HOT 5 CLOSED

Hi Aaron,

Thank you for putting this in. Yes, it can happen.

The cleanup pass of a HTJ2K codeblock is made up of three sections; in order, they are: the magnitude-sign (MagSgn) section, which is read from the first byte going forward; the MEL section, which is also read forward; and the VLC section, which is read from the last byte going backward.

For convenience, here we read 4 bytes at a time from the VLC section. So if the MagSgn and MEL are short (the MEL section can have 0 bytes), there is the possibility that when we reading from the VLC section, we read from before the first byte of the MagSgn section (i.e., from before the first byte in the codeblock).

This needs to be fixed. Let's keep this issue open until I fix it.

Thank you again.

Kind regards,
Aous.

from openjph.

Great, thanks for the explanation, and for looking into this.

from openjph.

Hi Aaron,

I should have come earlier, but my head is in another project.

I added 8 bytes in front of the buffer. If vlcp->size becomes smaller than -8, an error message will terminate the code. There is an additional 24 bytes of memory before the vlcp->buf field, which are used to store information about the buffer size and the likes; have a look at 'struct coded_lists' in ojph_mem.h if you like.

I could not replicate the issue with valgrind (this is the first time I use it), but since I knew about the possibility, I added the extra space, in addition to the existing 24 bytes. In any case, the code should not read from these 24 bytes.

It can useful to replicate the issue you faced. The bug might be somewhere else. I need more details, so if you have the time, please provide more details. You linked the original ppm file, but I am not very sure what options were used with it. I am also not very sure what options were given to valgrind.

While fiddling with valgrind, I discovered a bug in the encoder, which I totally overlooked in the past. I think I need to add valgrind to the necessary tools in my repertoire.

Thank you for all your help.

Kind regards,
Aous.

from openjph.

Hi Aous,
Thanks a lot for these fixes. Yes, valgrind is a fantastic tool to have in your toolkit.
I will do some more testing, and share the settings I used.
Best,
Aaron

from openjph.

I haven't found any valgrind errors in a while. Closing.

from openjph.