Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

demonstrate undefined behaviour in opj_decompress #1442

Open
wants to merge 10 commits into
base: master
Choose a base branch
from

Conversation

pauldreik
Copy link

@pauldreik pauldreik commented Aug 25, 2022

I ran afl and found a few issues. This pull request contains script and data to reproduce it, plus asserts in the code. I used ubuntu 22.04.

I filed issues #1443, #1444 and #1445 demonstrated by this pull request.

To reproduce, build with sanitizers:

sudo apt install afl++
cd tests/fuzzers/afl
./build-afl.sh

Then execute the crash test cases:

xx@xxx:~/code/openjpeg/tests/fuzzers/afl$ build-clang-release-replay/bin/opj_decompress -i crashes/color_1077_1123 -o tmp.bmp

===========================================
The extension of this file is incorrect.
FOUND 1123. SHOULD BE .jp2 or .jph
===========================================

[INFO] Start to read j2k main header (85).
[WARNING] Despite JP2 BPC!=255, precision and/or sgnd values for comp[1] is different than comp[0]:
        [0] prec(31) sgnd(0) [1] prec(8) sgnd(0)
[WARNING] Despite JP2 BPC!=255, precision and/or sgnd values for comp[2] is different than comp[0]:
        [0] prec(31) sgnd(0) [2] prec(8) sgnd(0)
[INFO] Main header has been correctly decoded.
[INFO] No decoded area parameters, set the decoded area to the whole image
[INFO] Header of tile 1 / 1 has been read.
[INFO] Stream reached its end !
/home/surfer/code/openjpeg/src/bin/common/color.c:1077:24: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/surfer/code/openjpeg/src/bin/common/color.c:1077:24 in 
/home/surfer/code/openjpeg/src/bin/common/color.c:1077:49: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/surfer/code/openjpeg/src/bin/common/color.c:1077:49 in 
/home/surfer/code/openjpeg/src/bin/common/color.c:1123:15: runtime error: 2.21034e+09 is outside the range of representable values of type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/surfer/code/openjpeg/src/bin/common/color.c:1123:15 in 
imagetobmp: only first component of 3 is used.
BMP CONVERSION: Truncating component 0 from 31 bits to 8 bits
[INFO] Generated Outfile tmp.bmp
decode time: 1 ms

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant