Heap use-after-free

[Ruia-ruia]

There is a heap use-after-free vulnerability in openjpeg/build/bin/libopenjp2.so.7.
I would also like to request a CVE if that's okay or I can do it myself if you're busy, no worries.

Here is the ASAN output:
out.txt

Here is the command executed to reproduce the issue:
./opj_decompress -ImgDir Inputs/ -OutFor PGM

If you would also like the files I have in the Inputs/, let me know and I can find a way to provide them.

[rouault]

There is a heap use-after-free vulnerability in openjpeg/build/bin/libopenjp2.so.7.

Can you reproduce it with latest master ?

I would also like to request a CVE if that's okay

yes, if you need one, please file the request

If you would also like the files I have in the Inputs/

yes, that would be needed to investigate the issue

[Ruia-ruia]

What is your preferred way of receiving the necessary input files?

[rouault]

What is your preferred way of receiving the necessary input files?

I don't care. Ideally if they are small, attached to this ticket. Otherwise if too large, a URL to a Dropbox or something equivalent

[Ruia-ruia]

By the way, after reviewing the source code I believe (though may be wrong) the issue emerges on the fulfillment of these conditions:

1. There are more than one files in the directory.
2. One of the files does not have a good header.
3. One of the files does have a good header.

This means that opj_image_destroy is called twice on the same image. The use-after-free is more specifically a read-after-free and occurs when opj_image_destroy tries to read from the image after it has been freed: if (image->comps)

On the first iteration of:

1395:  
for (imageno = 0; imageno < num_images ; imageno++) 

The image is destroyed as per:

1773: 
/* free image data structure */
opj_image_destroy(image);

Then because there is a file in the Input/ directory, whose header cannot be read, a second call to opj_image_destroy occurs on the second iteration of the for loop at image.c:1395

1480: 
if (! opj_read_header(l_stream, l_codec, &image)) {
            fprintf(stderr, "ERROR -> opj_decompress: failed to read the header\n");
            opj_stream_destroy(l_stream);
            opj_destroy_codec(l_codec);
            opj_image_destroy(image);
            failed = 1;
            goto fin;
        }

Note that there is a second iteration because that's how many files there are in the Input/ directory.

[Ruia-ruia]

https://www.dropbox.com/sh/yjvwmxo99d98yry/AADfYGBHaRb08mRQYPfd2oJna?dl=0

Here is a link to download the two files which need to be in Input/

[carnil]

This apparently was assigned CVE-2020-15389.