Re: Stack smashing in libjpeg-turbo

[Michal Zalewski <lcamtuf () coredump cx>]

A-ha, I was able to repro with ImageMagick + libjpeg-turbo 1.2.1.

Versions of libjpeg-turbo prior to 1.3.1 accept the file, while 1.3.1
rejects it outright due to duplicate SOI markers. This is probably
attributable to this change:

[4] Fixed a couple of issues whereby malformed JPEG images would cause
libjpeg-turbo to use uninitialized memory during decompression.

...which I think is related to CVE-2013-6629 and CVE-2013-6630. But I
haven't spent much time on it, so I'm not sure if that actually fixed
the underlying issue, or just made the file invalid for some unrelated
reason.

The fault is in:

...
#6  0x0066e504 in __stack_chk_fail_local () from /usr/lib/libjpeg.so.62
#7  0x0063f9c7 in encode_mcu_huff (cinfo=0xbfffbbf0,
MCU_data=0xb49043f8) at jchuff.c:642 <- boop
#8  0x0063323f in compress_output (cinfo=0xbfffbbf0, input_buf=0x0) at
jccoefct.c:381
#9  0x00632b37 in jpeg_finish_compress (cinfo=0xbfffbbf0) at jcapimin.c:183
#10 0x08319773 in WriteJPEGImage ()
#11 0x0839c8aa in WriteImage ()
#12 0x0839d5f3 in WriteImages ()

FWIW, Debian bug is here:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=768369

Which points to:
http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26482&sid=81658bc2f51a8d9893279cd01e83783f

The test case is at:
http://tapani.tarvainen.info/linux/convertbug/r270/003632r270.jpg

/mz