jasper/REDTEAM-CVE-2021-3272

[ChrisTimperley]

                Running Concrete Execution
                ------------------------------------------------------------------------------------------

                     Using Arguments: ['--input', '$POC', '--output', 'output.jp2']
                     Using Input File: /CrashRepair/experiments/vulnloc/jasper/REDTEAM-CVE-2021-3272/exploit
                building program
                        setting environment variables
                        cleaning files
                        configuring program
                        compiling program
                     Using Binary: /data/vulnloc/jasper/REDTEAM-CVE-2021-3272/src/src/appl/jasper
                extracting bytecode
                executing klee in concrete mode
                extracting instruction trace
                [warning] Unknown Crash Reason: __ubsan_handle_type_mismatch_v1

                        [note] program crashed
                [warning] Unknown Crash Reason: __ubsan_handle_type_mismatch_v1

                collecting tainted expressions
                collecting tainted concrete values
/usr/bin/crepair: line 5: 151767 Killed                  python3.8 "$(dirname $SCRIPT_DIR)/Repair.py" "$@"
FATAL ERROR: analysis failed: no localization file was produced

[ChrisTimperley]

@rshariffdeen What's the latest with this one?

[rshariffdeen]

Analysis generates a correct constraint in commit 5681825

[ChrisTimperley]

Thanks for taking a look.

The constraint fails to compile because of a type mismatch (specifically 8 * dec):

/data/vulnloc/jasper/REDTEAM-CVE-2021-3272/src/src/libjasper/jp2/jp2_dec.c:3510:13: error: invalid operands to binary expression ('int' and 'jp2_dec_t *')
  if (!(((8 * dec) < crepair_size(dec->image->cmpts_)))) { return image; } ((dec->image)->cmpts_[(i)]->type_ = (0x10000));

[rshariffdeen]

this isn't a blocker for getting the repair, the candidate space include the patch if (!(((8 * dec->chantocmptlut[i]) < crepair_size(dec->image->cmpts_)))) { exit(1); }

which is similar to dev patch, however the link to ghost library function is not properly set, @ChrisTimperley hope you can figure this out and get it working?

[ChrisTimperley]

I'm not quite sure what you mean by the link to the ghost library function not being sent, but I can see that the candidate space contains the patch you mentioned and that unrelated warnings appear to be preventing it from compiling. I can take a look at that.

[ChrisTimperley]

Ah, I think that I see what you mean below all of the warnings:

49 warnings generated.
[  3%] Linking C static library libjasper.a
[ 89%] Built target libjasper
[ 91%] Linking C executable imginfo
../libjasper/libjasper.a(jp2_dec.c.o): In function `jp2_decode':
/data/vulnloc/jasper/REDTEAM-CVE-2021-3272/src/src/libjasper/jp2/jp2_dec.c:3529: undefined reference to `crepair_size'

[rshariffdeen]

@ChrisTimperley were you able to resolve this issue?

[ChrisTimperley]

Not yet. Just arrived at ICRA. I'll try to take a look between sessions today. How's progress on the rest of the scenarios?