From 8308060d3fbc1da10353ac8a95c8ea60eba9c25a Mon Sep 17 00:00:00 2001 From: Michael Adams Date: Tue, 5 Aug 2025 20:46:48 -0700 Subject: [PATCH] Fixes #402, #403. JPEG-2000 (JPC) Decoder: - Added the setting of several pointers to null in some cleanup code after the pointed-to memory was freed. This pointer nulling is not needed normally, but it is needed when certain debugging logs are enabled (so that the debug code understands that the memory associated with the aforementioned pointers has been freed). CVE: CVE-2025-8837 Upstream: https://github.com/jasper-software/jasper/commit/8308060d3fbc1da10353ac8a95c8ea60eba9c25a [thomas: removed the binary blob, adapt line] Signed-off-by: Thomas Perale --- src/libjasper/jpc/jpc_dec.c | 13 ++++++++----- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/src/libjasper/jpc/jpc_dec.c b/src/libjasper/jpc/jpc_dec.c index 125a29ba..7e44f052 100644 --- a/src/libjasper/jpc/jpc_dec.c +++ b/src/libjasper/jpc/jpc_dec.c @@ -1107,23 +1107,23 @@ static int jpc_dec_tilefini(jpc_dec_t *dec, jpc_dec_tile_t *tile) if (tile->cp) { jpc_dec_cp_destroy(tile->cp); - //tile->cp = 0; + tile->cp = 0; } if (tile->tcomps) { jas_free(tile->tcomps); - //tile->tcomps = 0; + tile->tcomps = 0; } if (tile->pi) { jpc_pi_destroy(tile->pi); - //tile->pi = 0; + tile->pi = 0; } if (tile->pkthdrstream) { jas_stream_close(tile->pkthdrstream); - //tile->pkthdrstream = 0; + tile->pkthdrstream = 0; } if (tile->pptstab) { jpc_ppxstab_destroy(tile->pptstab); - //tile->pptstab = 0; + tile->pptstab = 0; } tile->state = JPC_TILE_DONE; @@ -2259,6 +2259,9 @@ static int jpc_dec_dump(const jpc_dec_t *dec) const jpc_dec_tile_t *tile; for (tileno = 0, tile = dec->tiles; tileno < dec->numtiles; ++tileno, ++tile) { + if (!tile->tcomps) { + continue; + } assert(!dec->numcomps || tile->tcomps); unsigned compno; const jpc_dec_tcomp_t *tcomp;