Integer Overflow at j2k.c:11114

[headshog]

Hi! We've been fuzzing openjpeg with sydr-fuzz security predicates and we found integer overflow error in j2k.c:11114.

In function opj_j2k_read_SQcd_SQcc at line 11114 integer overflow occurs in pointer's p_header_size value (in our case *p_header_size was 0 and l_num_band is 2). I've just added two checkers for that overflow case in both branches of if (l_tccp->qntsty == J2K_CCP_QNTSTY_NOQNT) and it's else statement.

Environment

• OS: ubuntu 20.04
• commit: 6af3931

How to reproduce this error

1. Build docker container:

   sudo docker build -t oss-sydr-fuzz-openjpeg .
   

2. Run docker container:

   sudo docker run --privileged --network host -v /etc/localtime:/etc/localtime:ro --rm -it -v $PWD:/fuzz oss-sydr-fuzz-openjpeg /bin/bash
   

3. Run on the following input:

    /opj_decompress_fuzzer_J2K_fuzz  sydr_j2k_header.txt
   

4. Output:

   /openjpeg/src/lib/openjp2/j2k.c:11114:41: runtime error: unsigned integer overflow: 0 - 2 cannot be represented in type 'unsigned int'
   SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /openjpeg/src/lib/openjp2/j2k.c:11114:41