Out-of-Bounds Read/Write in OpenJPEG

Executive Summary

This vulnerability is an out-of-bounds read and write flaw in OpenJPEG versions 2.4.0 through 2.5.4 and the git master branch. It occurs in the function opj_dwt_encode_and_deinterleave_v() during the vertical pass of the Discrete Wavelet Transform (DWT) in image encoding. When a tile's resolution level has zero height at an odd start coordinate, the function accesses memory outside the allocated buffer, causing heap corruption. This leads to denial of service through process termination.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, compile OpenJPEG with AddressSanitizer or similar tools and run encoding operations repeatedly. Use commands like 'gcc -fsanitize=address' during compilation and test with 'opj_compress' or 'opj_decompress' on sample images. Check for heap corruption errors during execution.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to cause a denial of service by crashing applications using OpenJPEG. Repeated encoding operations in the same process trigger heap corruption, detected by glibc's heap checks. While normal encoding may appear unaffected, the vulnerability can lead to program termination or potential further exploits if left unpatched.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the proposed patch adding a height==0 check in opj_dwt_encode_and_deinterleave_v(). If unavailable, downgrade to OpenJPEG versions before 2.4.0 or disable JPEG2000 encoding in applications. Monitor upstream for updates as the project is currently unmaintained.

Useful 0 Not Useful 0