Re: Re: Integer overflow in the JasPer's jas_matrix_create() function

[Stefan Cornelius <scorneli () redhat com>]

On Thu,  7 Jan 2016 21:41:57 -0500 (EST)
cve-assign () mitre org wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> > > https://bugzilla.redhat.com/show_bug.cgi?id=1294039  
>
> > We find a vulnerability in the way JasPer's jas_matrix_create()
> > function parsed certain JPEG 2000 image files.
> >
> > jas_matrix_t *jas_matrix_create(int numrows, int numcols)
> > {
> >         .......
> >
> >         if (matrix->maxrows_ > 0) {
> >                 if (!(matrix->rows_ = jas_malloc(matrix->maxrows_ *
> >                   sizeof(jas_seqent_t *)))) {
> >   
>
> > matrix->maxrows_ > 0 ,but matrix->maxrows_ *sizeof(jas_seqent_t *)
> > can cause Integer overflow.
> >
> > Despite this library is used by many programs
> > (http://www.ece.uvic.ca/~frodo/jasper/#overview), there is no one
> > providing support.  
>
> Use CVE-2015-8751.

Hi,

Just a quick heads-up: We at Red Hat originally fixed this as part of
the patch for CVE-2008-3520. This was a rather big patch and
closed a lot of potential integer overflows (originally from
OpenBSD?). I imagine a lot of distros used the same patch.

The original description for CVE-2008-3520 is quite general, so I'm
not sure if that's enough to say that CVE-2015-8751 is a dupe or not.

-- 
Stefan Cornelius / Red Hat Product Security