Assertion failure in stbi__jpeg_huff_decode, stb_image.h:1894

[waugustus]

Description

There is an assertion failure error in stbi__jpeg_huff_decode, stb_image.h:1894. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted jpg file.

Version

img2sixel 1.8.6, commit id 6a5be8b (Tue Jan 14 02:27:00 2020 +0900)

Reproduction

# img2sixel poc -o /tmp/foo
img2sixel: stb_image.h:1894: stbi__jpeg_huff_decode: Assertion `(((j->code_buffer) >> (32 - h->size[c])) & stbi__bmask[h->size[c]]) == h->code[c]' failed.
Aborted (core dumped)

poc.zip

Platfrom

# uname -a
Linux 4a409ce47130 5.4.0-70-generic #78~18.04.1-Ubuntu SMP Sat Mar 20 14:10:07 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

[carnil]

Can you report the issue to the new upstream at https://github.com/libsixel/libsixel ?

[waugustus]

Can you report the issue to the new upstream at https://github.com/libsixel/libsixel ?

OK, and thank you for your suggestion.

[waugustus]

CVE-2022-29977 assigned.

[j4james]

I believe this was fixed in the libsixel/libsixel fork when the stb_image library was upgrade to v2.30 as part of PR libsixel#83.

[saitoha]

@waugustus I have cherry-picked @hzeller's libsixel#83. Thank you!