OOM in opj_decompress

[LOURC0D3]

Expected behavior and actual behavior.

If an attacker inputs a maliciously crafted file to opj_decompress, opj_decompress will consume RAM until exhausted.

dmesg log

[19395.257621] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/user.slice/user-1001.slice/[email protected]/app.slice/app-org.gnome.Terminal.slice/vte-spawn-bfb74d30-24d2-42e9-a6c7-66ba9ccba97e.scope,task=opj_decompress,pid=332886,uid=1001
[19395.257635] Out of memory: Killed process 332886 (opj_decompress) total-vm:21477025544kB, anon-rss:7378548kB, file-rss:0kB, shmem-rss:0kB, UID:1001 pgtables:19316kB oom_score_adj:0

poc video

crash.mov

Steps to reproduce the problem.

• build option

mkdir build && cd build
cmake .. 
make -j `nproc`

• run command

opj_decompress -i crash.j2k -o test.pgm

• crash file
  crash

Operating system

Ubuntu 22.04.2 LTS

openjpeg version

[LOURC0D3]

It seems to be the same as issue #1471 .
Close this issue.