CVE-2014-8157: Use After Free

oCERT reports an issue in jasper discovered by pyddeh:

"""

jpcdec.c:1204:

dec->numhtiles = JPCCEILDIV(dec->xend - dec->tilexoff, dec->tilewidth); dec->numvtiles = JPCCEILDIV(dec->yend - dec->tileyoff, dec->tileheight); dec->numtiles = dec->numhtiles dec->numvtiles; if (!(dec->tiles = jasmalloc(dec->numtiles sizeof(jpcdectilet)))) { return -1; }

the dec->XXX in JPCCEILDIV are all directly from the codestream, so dec->numtiles can be 0. In that case, the minimum-sized chunk returned by malloc can, depending on the code stream, be used later. I think this can cause the same problems as a use after free. Fix proposal:

if ( dec->numtiles == 0 || !(dec->tiles = jasmalloc(dec->numtiles sizeof(jpcdectilet)))) { return -1; }

"""

Acknowledgement:

Red Hat would like to thank oCERT for reporting this issue. oCERT acknowledges pyddeh as the original reporter.