Description
OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row codeblocks. Attackers can supply a crafted .j2c or .jph codestream with small precinct sizes, causing the decoder to write a second row past the codeblock buffer, resulting in memory corruption and crashes.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
aous72 OpenJPH
Default version status: unaffected
0 to ≤ 0.32.0affected
References
- https://hackmd.io/@haind-pwn/openjph-htj2k-degenerate-codeblock-cleanup-oob-write ↗
- https://github.com/aous72/OpenJPH/blob/23c422895ce6c3a156935222e4715ee0b7be952c/src/core/codestream/ojph_subband.cpp#L136-L142 ↗
- https://github.com/aous72/OpenJPH/blob/23c422895ce6c3a156935222e4715ee0b7be952c/src/core/codestream/ojph_codeblock.cpp#L79-L84 ↗
- https://github.com/aous72/OpenJPH/blob/23c422895ce6c3a156935222e4715ee0b7be952c/src/core/coding/ojph_block_decoder32.cpp#L1135-L1155 ↗
- https://github.com/aous72/OpenJPH ↗
- https://www.vulncheck.com/advisories/openjph-through-0.32.0-heap-out-of-bounds-write-in-htj2k-cleanup-pass-decoder ↗