CVE-2016-1577: Double Free

A double free vulnerability in jasiccattrvaldestroy function in JasPer 1.900.1 and earlier allowing remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file was found.

Vulnerable code:

src/libjasper/base/jasicc.c: 258 jasiccproft jasiccprofload(jasstreamt in) 259 { ... 294 for (i = 0; i < numtags; ++i) { 295 tagtabent = &prof->tagtab.ents[i]; 296 if (tagtabent->off == JASCAST(jasiccuint32t, prevoff)) { 297 if (prevattrval) { 298 if (!(attrval = jasiccattrvalclone(prevattrval))) 299 goto error; 300 if (jasiccprofsetattr(prof, tagtabent->tag, attrval)) 301 goto error; 302 jasiccattrvaldestroy(attrval); 303 } else { 304 #if 0 305 jaseprintf("warning: skipping unknown tag type\n"); 306 #endif 307 } 308 continue; 309 } 310 reloff = tagtabent->off - curoff; 311 if (reloff > 0) { 312 if (jasstreamgobble(in, reloff) != reloff) 313 goto error; 314 curoff += reloff; 315 } else if (reloff < 0) { 316 / This should never happen since we read the tagged 317 element data in a single pass. / 318 abort(); 319 } 320 prevoff = curoff; 321 if (jasiccgetuint32(in, &type)) { 322 goto error; 323 } 324 if (jasstreamgobble(in, 4) != 4) { 325 goto error; 326 } 327 curoff += 8; 328 if (!(attrvalinfo = jasiccattrvalinfolookup(type))) { 329 #if 0 330 jaseprintf("warning: skipping unknown tag type\n"); 331 #endif 332 prevattrval = 0; 333 continue; 334 } 335 if (!(attrval = jasiccattrvalcreate(type))) { 336 goto error; 337 } ... 353 error: 354 if (prof) 355 jasiccprofdestroy(prof); 356 if (attrval) 357 jasiccattrvaldestroy(attrval); 358 return 0; 359 }

attrval variable is assigned on line 298 and freed with the call to jasiccattrvaldestroy() on line 302. If the tests on lines 312, 321, or 324 are true, the same pointer will be passed a second time to jasiccattrvaldestroy() on line 357.

Proposed patch:

http://seclists.org/oss-sec/2016/q1/att-507/CVE-2016-1577.patch

Public via:

http://seclists.org/oss-sec/2016/q1/507