memory & cpu are exhausted when converting jp2 file into png

[SuhwanSong]

Description

The memory & cpu are exhausted when converting jp2 file into png.
openjpeg is terminated when the 512GB memory is exhausted (in my computer).

Here's log.

===========================================
The extension of this file is incorrect.
FOUND ep:2. SHOULD BE .jp2
===========================================

[INFO] Start to read j2k main header (85).
[WARNING] Unknown marker
[INFO] Main header has been correctly decoded.
[INFO] No decoded area parameters, set the decoded area to the whole image
AddressSanitizer: Out of memory. Dying. The process has exhausted 65536MB for size class 320.

GDB log.

#0  opj_tcd_code_block_dec_allocate (p_code_block=0x7ffff1d6f4f0) at openjpeg/src/lib/openjp2/tcd.c:1277
#1  0x00007ffff6bdee1c in opj_tcd_init_tile (p_tcd=0x60b000000040, p_tile_no=0, isEncoder=0, fraction=0.5, sizeof_block=72, manager=0x6100000000a0)
    at openjpeg/src/lib/openjp2/tcd.c:1168
#2  0x00007ffff6bdf24c in opj_tcd_init_decode_tile (p_tcd=0x60b000000040, p_tile_no=0, p_manager=0x6100000000a0)
        at openjpeg/src/lib/openjp2/tcd.c:1200
#3  0x00007ffff6b2f605 in opj_j2k_read_tile_header (p_j2k=0x613000000040, p_tile_index=0x7fffffff8760, p_data_size=0x0, p_tile_x0=0x7fffffff87a0,
        p_tile_y0=0x7fffffff87e0, p_tile_x1=0x7fffffff8820, p_tile_y1=0x7fffffff8860, p_nb_comps=0x7fffffff88a0, p_go_on=0x7fffffff8720,
            p_stream=0x60c000000040, p_manager=0x6100000000a0) at openjpeg/src/lib/openjp2/j2k.c:9467
#4  0x00007ffff6b3dde7 in opj_j2k_decode_tiles (p_j2k=0x613000000040, p_stream=0x60c000000040, p_manager=0x6100000000a0)
    at openjpeg/src/lib/openjp2/j2k.c:11346
#5  0x00007ffff6b2a6e2 in opj_j2k_exec (p_j2k=0x613000000040, p_procedure_list=0x602000000030, p_stream=0x60c000000040, p_manager=0x6100000000a0)
        at openjpeg/src/lib/openjp2/j2k.c:8690
#6  0x00007ffff6b4048a in opj_j2k_decode (p_j2k=0x613000000040, p_stream=0x60c000000040, p_image=0x604000000090, p_manager=0x6100000000a0)
            at openjpeg/src/lib/openjp2/j2k.c:11666
#7  0x00007ffff6b4daef in opj_jp2_decode (jp2=0x60f000000040, p_stream=0x60c000000040, p_image=0x604000000090, p_manager=0x6100000000a0)
                at openjpeg/src/lib/openjp2/jp2.c:1601
#8  0x00007ffff6b5bc5d in opj_decode (p_codec=0x610000000040, p_stream=0x60c000000040, p_image=0x604000000090)
                    at openjpeg/src/lib/openjp2/openjpeg.c:483
#9  0x000055555556659d in main (argc=5, argv=0x7fffffffdd18) at openjpeg/src/bin/jp2/opj_decompress.c:1542

Steps to Reproduce

please run following command line
opj_decompress -i $PoC -o t.png

poc

System Configuration

• Environment (Operating system, version and so on):
• Description:
  Ubuntu 18.04.1 LTS
  Release: 18.04
• Additional information:
  CC=clang-9 CXX=clang++-9

[rouault]

Likely a duplicate / similar instance of #1178

[szukw000]

BASE(id_000008,src_002031,op_havoc,rep_2.jp2)

read_jp2.c:1538:
    name(ftyp)
read_jp2.c:1541: hstep(8)
   brand(jp2 ) minv(0)
   CL[0](jp2 )
read_jp2.c:1538:
    name(jp2h)
read_jp2.c:1541: hstep(8)
JP2H pos(32) len(45)
read_jp2.c:933:
    read_jp2h
    BOX name(ihdr) len(22)
IHDR box_len(22)
read_ihdr
    w(32) h(0) nc(3) bpc(7)
    signed(0) depth(8)
    compress(7) unknown_c(0) ipr(0)

The patch I use tests for 'w < 1 || h < 1 || numcomps < 1':

 bin/opj_decompress -i /home/szukw000/OPENJPEG/ISSUE-1250/id_000008,src_002031,op_havoc,rep_2.jp2 -o out.png

[ERROR] Wrong values for: w(32) h(0) numcomps(3)
ERROR -> opj_decompress: failed to read the header


--- jp2.c.orig  2020-05-25 18:37:55.513998530 +0200
+++ jp2.c   2020-05-25 18:43:17.992997615 +0200
@@ -586,6 +586,12 @@
     opj_read_bytes(p_image_header_data, &(jp2->numcomps), 2);   /* NC */
     p_image_header_data += 2;

+    if (jp2->h < 1 || jp2->w < 1 || jp2->numcomps < 1) {
+        opj_event_msg(p_manager, EVT_ERROR,
+            "Wrong values for: w(%d) h(%d) numcomps(%d)\n",
+            jp2->w, jp2->h, jp2->numcomps);
+        return OPJ_FALSE;
+    }
     if ((jp2->numcomps - 1U) >=
             16384U) { /* unsigned underflow is well defined: 1U <= jp2->numcomps <= 16384U */
         opj_event_msg(p_manager, EVT_ERROR, "Invalid number of components (ihdr)\n");

winfried

[szukw000]

@rouault ,
a PR #1254 has been added.
winfried