OpenHTJ2K Buffer Overflow Vulnerability Allowing Arbitrary Code Execution

A buffer overflow vulnerability has been identified in OpenHTJ2K versions through 0.18.4. This vulnerability allows an attacker to execute arbitrary code by exploiting the openhtj2k_decoder_impl::invoke, invoke_line_based, invoke_line_based_stream, and invoke_line_based_predecoded functions in source/core/interface/decoder.cpp. The issue arises from unchecked tile indices in the J2K tile dispatch process, leading to out-of-bounds memory access and information leaks.

Impact

Exploitation of this vulnerability causes a heap-based buffer overflow, allowing for arbitrary code execution. Additionally, there is a confirmed server-side heap information leak, where sensitive heap pointer values can be extracted and potentially exploited.

Reproduction

The vulnerability can be reproduced by crafting J2K or JP2 files that include malformed tile index data. When these files are processed by the OpenHTJ2K decoder or served through a JPIP server, the unchecked tile indices will cause out-of-bounds memory access, leading to a heap buffer overflow and information leak.

Remediation

Users are advised to upgrade to OpenHTJ2K version 0.18.5, which addresses the vulnerability by validating SOT tile indices before processing, preventing out-of-bounds memory access and associated information leaks.