openjpeg 2.4.0 through 2.5.4 and git master: heap buffer overflow in opj_dwt_encode_and_deinterleave_v() (reversible 5/3 forward DWT, encoder)
OpenJPEG 2.4.0 through 2.5.4 has an encoder-side heap overflow in its reversible 5/3 wavelet transform.
Red Eagle Tech reported a heap buffer overflow in OpenJPEG's opj_dwt_encode_and_deinterleave_v(), affecting versions 2.4.0 through 2.5.4 and git master. The reversible 5/3 forward wavelet transform reads and writes past a heap allocation when a tile's lower resolution levels have zero height at an odd start. The flaw is encoder-side and is reached through encoding parameters, not a crafted input file. A single encode may appear fine, while repeating the same encode in one process can expose the bug.
- Heap overflow in opj_dwt_encode_and_deinterleave_v()
- Affects OpenJPEG 2.4.0 through 2.5.4 and git master
- Encoder-side bug, not triggered by a crafted image
- Triggered when lower levels have zero height at an odd start
Posted by Security @ Red Eagle Tech on Oct 05 Hello, OpenJPEG's reversible (5/3) forward wavelet transform reads and writes past the end of a heap allocation when a tile's lower resolution levels have zero height at an odd start. It is an encoder-side issue, not a decoder one: it is reached through the encoding parameters, not through a crafted input file. A single encode usually looks fine. Repeat the same encode in one process, as any program that encodes more than one image...
This source does not provide full text. Read it at seclists.org.