payload: {"action":"created","issue":{"url":"https://api.github.com/repos/Exiv2/exiv2/issues/950","repository_url":"https://api.github.com/repos/Exiv2/exiv2","labels_url":"https://api.github.com/repos/Exiv2/exiv2/issues/950/labels{/name}","comments_url":"https://api.github.com/repos/Exiv2/exiv2/issues/950/comments","events_url":"https://api.github.com/repos/Exiv2/exiv2/issues/950/events","html_url":"https://github.com/Exiv2/exiv2/issues/950","id":466263063,"node_id":"MDU6SXNzdWU0NjYyNjMwNjM=","number":950,"title":"CVE-2018-20099 infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp","user":{"login":"zjuchenyuan","id":17289004,"node_id":"MDQ6VXNlcjE3Mjg5MDA0","avatar_url":"https://avatars2.githubusercontent.com/u/17289004?v=4","gravatar_id":"","url":"https://api.github.com/users/zjuchenyuan","html_url":"https://github.com/zjuchenyuan","followers_url":"https://api.github.com/users/zjuchenyuan/followers","following_url":"https://api.github.com/users/zjuchenyuan/following{/other_user}","gists_url":"https://api.github.com/users/zjuchenyuan/gists{/gist_id}","starred_url":"https://api.github.com/users/zjuchenyuan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zjuchenyuan/subscriptions","organizations_url":"https://api.github.com/users/zjuchenyuan/orgs","repos_url":"https://api.github.com/users/zjuchenyuan/repos","events_url":"https://api.github.com/users/zjuchenyuan/events{/privacy}","received_events_url":"https://api.github.com/users/zjuchenyuan/received_events","type":"User","site_admin":false},"labels":[{"id":593399971,"node_id":"MDU6TGFiZWw1OTMzOTk5NzE=","url":"https://api.github.com/repos/Exiv2/exiv2/labels/bug","name":"bug","color":"ee0701","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-07-10T11:48:32Z","updated_at":"2019-07-10T22:25:09Z","closed_at":null,"author_association":"NONE","body":"**Describe the bug**\r\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20099\r\n\r\nThere is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.\r\n\r\nThis has been reported in #590 , but @piponazo ignored due to not `cp CVE-2018-20099 CVE-2018-20099.exv`\r\n\r\nThis CVE has not been fixed on current commit `1de8e734`\r\n\r\n**To Reproduce**\r\nSteps to reproduce the behaviour:\r\n1. download the [POC file](https://github.com/TeamSeri0us/pocs/raw/master/exiv2/20181206/jp2image-infiniteloop-poc-5)\r\n2. Provide exact command to reproduce the issue\r\n\r\n```\r\nwget https://github.com/TeamSeri0us/pocs/raw/master/exiv2/20181206/jp2image-infiniteloop-poc-5\r\nmv jp2image-infiniteloop-poc-5 CVE-2018-20099\r\ncp CVE-2018-20099 CVE-2018-20099.exv\r\n./exiv2 insert CVE-2018-20099\r\n```\r\n\r\n**Expected behavior**\r\ninfinite loop\r\n\r\n**Desktop (please complete the following information):**\r\n - OS: Ubuntu 16.04 \r\n - Compiler & Version gcc version 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.11)\r\n - Compilation mode and/or compiler flags: using afl-gcc and ASAN\r\n\r\n**Additional context**\r\n\r\npress `Ctrl+Break` to let gdb break\r\n\r\n```\r\nroot@66b85dd83778:/d/cvepoc/exiv2# gdb /d/p/latest/1.exiv2\r\nGNU gdb (Ubuntu 7.11.1-0ubuntu1~16.5) 7.11.1\r\nCopyright (C) 2016 Free Software Foundation, Inc.\r\nLicense GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>\r\nThis is free software: you are free to change and redistribute it.\r\nThere is NO WARRANTY, to the extent permitted by law.  Type \"show copying\"\r\nand \"show warranty\" for details.\r\nThis GDB was configured as \"x86_64-linux-gnu\".\r\nType \"show configuration\" for configuration details.\r\nFor bug reporting instructions, please see:\r\n<http://www.gnu.org/software/gdb/bugs/>.\r\nFind the GDB manual and other documentation resources online at:\r\n<http://www.gnu.org/software/gdb/documentation/>.\r\nFor help, type \"help\".\r\nType \"apropos word\" to search for commands related to \"word\"...\r\nReading symbols from /d/p/latest/1.exiv2...done.\r\n(gdb) r insert CVE-2018-20099\r\nStarting program: /d/p/latest/1.exiv2 insert CVE-2018-20099\r\n[Thread debugging using libthread_db enabled]\r\nUsing host libthread_db library \"/lib/x86_64-linux-gnu/libthread_db.so.1\".\r\n^C\r\nProgram received signal SIGINT, Interrupt.\r\n0x00007ffff64e4820 in Exiv2::getLong (buf=0x7fffffffb534 \"olr\\001\", byteOrder=<optimized out>) at /d/p/latest/exiv2/src/types.cpp:339\r\n339                        | (byte)buf[2] <<  8 | (byte)buf[3];\r\n(gdb) bt\r\n#0  0x00007ffff64e4820 in Exiv2::getLong (buf=0x7fffffffb534 \"olr\\001\", byteOrder=<optimized out>) at /d/p/latest/exiv2/src/types.cpp:339\r\n#1  0x00000ffffffff6a6 in ?? ()\r\n#2  0x000000006f6c7201 in ?? ()\r\n#3  0x0000000000000000 in ?? ()\r\n(gdb) list\r\n334                 return   (byte)buf[3] << 24 | (byte)buf[2] << 16\r\n335                        | (byte)buf[1] <<  8 | (byte)buf[0];\r\n336             }\r\n337             else {\r\n338                 return   (byte)buf[0] << 24 | (byte)buf[1] << 16\r\n339                        | (byte)buf[2] <<  8 | (byte)buf[3];\r\n340             }\r\n341         }\r\n342\r\n343         Rational getRational(const byte* buf, ByteOrder byteOrder)\r\n(gdb) finish\r\nRun till exit from #0  0x00007ffff64e4820 in Exiv2::getLong (buf=0x7fffffffb534 \"olr\\001\", byteOrder=<optimized out>) at /d/p/latest/exiv2/src/types.cpp:339\r\n^C\r\nProgram received signal SIGINT, Interrupt.\r\n0x00007ffff6ef65ed in __asan_memcpy () from /usr/lib/x86_64-linux-gnu/libasan.so.2\r\n(gdb) bt\r\n#0  0x00007ffff6ef65ed in __asan_memcpy () from /usr/lib/x86_64-linux-gnu/libasan.so.2\r\n#1  0x00007ffff63f51a1 in Exiv2::Jp2Image::encodeJp2Header (this=this@entry=0x61200000bd40, boxBuf=..., outBuf=...) at /d/p/latest/exiv2/src/jp2image.cpp:678\r\n#2  0x00007ffff63f752f in Exiv2::Jp2Image::doWriteMetadata (this=this@entry=0x61200000bd40, outIo=...) at /d/p/latest/exiv2/src/jp2image.cpp:789\r\n#3  0x00007ffff6403c0b in Exiv2::Jp2Image::writeMetadata (this=0x61200000bd40) at /d/p/latest/exiv2/src/jp2image.cpp:612\r\n#4  0x00000000004c8776 in (anonymous namespace)::metacopy (source=\"./CVE-2018-20099.exv\", tgt=\"CVE-2018-20099\", targetType=targetType@entry=Exiv2::ImageType::none, preserve=preserve@entry=true) at /d/p/latest/exiv2/src/actions.cpp:2021\r\n#5  0x00000000004ccd00 in Action::Insert::run (this=<optimized out>, path=\"CVE-2018-20099\") at /d/p/latest/exiv2/src/actions.cpp:1163\r\n#6  0x000000000040980c in main (argc=<optimized out>, argv=<optimized out>) at /d/p/latest/exiv2/src/exiv2.cpp:77\r\n```"},"comment":{"url":"https://api.github.com/repos/Exiv2/exiv2/issues/comments/510253951","html_url":"https://github.com/Exiv2/exiv2/issues/950#issuecomment-510253951","issue_url":"https://api.github.com/repos/Exiv2/exiv2/issues/950","id":510253951,"node_id":"MDEyOklzc3VlQ29tbWVudDUxMDI1Mzk1MQ==","user":{"login":"D4N","id":786021,"node_id":"MDQ6VXNlcjc4NjAyMQ==","avatar_url":"https://avatars2.githubusercontent.com/u/786021?v=4","gravatar_id":"","url":"https://api.github.com/users/D4N","html_url":"https://github.com/D4N","followers_url":"https://api.github.com/users/D4N/followers","following_url":"https://api.github.com/users/D4N/following{/other_user}","gists_url":"https://api.github.com/users/D4N/gists{/gist_id}","starred_url":"https://api.github.com/users/D4N/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/D4N/subscriptions","organizations_url":"https://api.github.com/users/D4N/orgs","repos_url":"https://api.github.com/users/D4N/repos","events_url":"https://api.github.com/users/D4N/events{/privacy}","received_events_url":"https://api.github.com/users/D4N/received_events","type":"User","site_admin":false},"created_at":"2019-07-10T22:25:09Z","updated_at":"2019-07-10T22:25:09Z","author_association":"MEMBER","body":"Thank you for bringing this to our attention!\r\n\r\nThe issue is relatively simple: the length of the generated `subBox` is zero, which means that the while loop in this [line](https://github.com/Exiv2/exiv2/blob/1de8e73488371d152a7d1a3cc1c1f810c8e2af54/src/jp2image.cpp#L635) never terminates."}}
other: {"actor":{"display_login":"D4N"}}