Assertion Failure in jp2.c

[thuanpv]

Hi,

This bug was found with AFLSmart, an input-structure aware extension of AFL.
It was found on Ubuntu 16.04 64-bit -- OpenJPEG d2205ba (HEAD)

To reproduce:

opj_decompress -i openjpeg_crash_3.jp2 -o out.png

Bug triggering file is attached. Please unzip it.

Error message:

[WARNING] Ignoring ihdr box. First ihdr box already read
[WARNING] Ignoring ihdr box. First ihdr box already read
[INFO] Start to read j2k main header (1387).
[INFO] Main header has been correctly decoded.
[INFO] No decoded area parameters, set the decoded area to the whole image
[INFO] Header of tile 1 / 2 has been read.
[INFO] Tile 1/2 has been decoded.
[INFO] Image data has been updated with tile 1.

[INFO] Header of tile 2 / 2 has been read.
[INFO] Tile 2/2 has been decoded.
[INFO] Image data has been updated with tile 2.

opj_decompress: /home/ubuntu/aflsmart-experiments/openjpeg/src/lib/openjp2/jp2.c:1109: opj_jp2_apply_pclr: Assertion `cmp == 0' failed.
Aborted

Thanks,

Thuan

openjpeg_crash_3.jp2.zip

[szukw000]

@thuanpv ,
Using the latest version of openjpeg:
Latest commit d2205ba on Jun 20 [2018]

szukw000: opj_decompress -i /tmp/openjpeg_crash_3.jp2 -o out.png

[WARNING] Ignoring ihdr box. First ihdr box already read
[WARNING] Ignoring ihdr box. First ihdr box already read
[INFO] Start to read j2k main header (1387).
[INFO] Main header has been correctly decoded.
[INFO] No decoded area parameters, set the decoded area to the whole image
[INFO] Header of tile 1 / 2 has been read.
[INFO] Tile 1/2 has been decoded.
[INFO] Image data has been updated with tile 1.

[INFO] Header of tile 2 / 2 has been read.
[INFO] Tile 2/2 has been decoded.
[INFO] Image data has been updated with tile 2.

[INFO] Stream reached its end !
[WARNING] Problem with skipping JPEG2000 box, stream error
imagetopng: All components shall have the same subsampling, same bit depth, same sign.
Aborting
[ERROR] Error generating png file. Outfile out.png not generated

//------------------------------------
This file obviously has difficulties with a latin-1 keyboard:

[102]marker(0xff64)
com len(37)
R[1](General use (ISO 8859-1 (latin-1) values))
T(CreaSed by OpenJPEG verszon 2.3.0)

More latin-1 bugs can be found in the attachment.

winfried
openjpeg_crash_3.jp2.log.zip