Abort in reconstruct.cpp:352 about libjpeg

[bladchan]

Hi, SEU-SSL
I used your poc but didn't trigger any bug.
Here's my output:

./jpeg ./poc2 /dev/null
jpeg Copyright (C) 2012-2018 Thomas Richter, University of Stuttgart
and Accusoft

For license conditions, see README.license for details.

*** Warning -1038 in Tables::ParseTables, line 1399, file tables.cpp
*** Reason is: found invalid marker, probably a marker size is out of range

*** Warning -1038 in Frame::StartParseHiddenScan, line 875, file frame.cpp
*** Reason is: Start of Scan SOS marker missing

*** Warning -1038 in Frame::ParseTrailer, line 1091, file frame.cpp
*** Reason is: missing an EOI marker at the end of the stream

*** Warning -1038 in Image::ParseTrailer, line 1468, file image.cpp
*** Reason is: expecting an EOI marker at the end of the stream


0 bytes memory not yet released.

15337 bytes maximal required.

84 allocations performed.

BTW, I used clang 6.0 to compile this library. Maybe this error is related to compiler environment?

[SEU-SSL]

Hi, SEU-SSL I used your poc but didn't trigger any bug. Here's my output:

./jpeg ./poc2 /dev/null
jpeg Copyright (C) 2012-2018 Thomas Richter, University of Stuttgart
and Accusoft

For license conditions, see README.license for details.

*** Warning -1038 in Tables::ParseTables, line 1399, file tables.cpp
*** Reason is: found invalid marker, probably a marker size is out of range

*** Warning -1038 in Frame::StartParseHiddenScan, line 875, file frame.cpp
*** Reason is: Start of Scan SOS marker missing

*** Warning -1038 in Frame::ParseTrailer, line 1091, file frame.cpp
*** Reason is: missing an EOI marker at the end of the stream

*** Warning -1038 in Image::ParseTrailer, line 1468, file image.cpp
*** Reason is: expecting an EOI marker at the end of the stream


0 bytes memory not yet released.

15337 bytes maximal required.

84 allocations performed.

BTW, I used clang 6.0 to compile this library. Maybe this error is related to compiler environment?

Hello, I guess this issue is fixed by this commit db33a6e
Perhaps you can try to reproduce the vulnerability with an earlier version.