2

CVE-2009-5030

OpenJPEG: Heap memory corruption leading to invalid free

The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an "invalid free".

What are the security implications of the invalid free? How might it be abused or exploited in a security context?

My interest in information security eventually led to an interest in computer science in general, not the other way around: always being less interested in cause than effect.

I recently began trying my hand at writing C code. It's going alright, but still amateur at best. Many of the lower level programming concepts (e.g. heap, memory management, etc.) continue to elude me to a certain extent.

I'm not particularly interested in the specific example provided above. It's just the most recent example (although patched long ago) to inadvertently come across my desk. Anyway, it's a term I'm all too familiar with, from reading and writing reports, yet I have no more than a vague or abstract understanding of what it really implies. Despite the frequency of occurrence, it seems considerably neglected in the common literature. The reports for the CVE above mention remote arbitrary code execution, but it seems to be in addition to the invalid free – the relationship is unclear.

Similar Terms

Improve this question
1
  • Double free can result in a memory block then being allocated twice, which results in a similar situation to use after free. With UAF, a pointer in one block can be overwritten by untrusted data in another block. Not all UAF our double free flaws are exploitable.
    – paj28
    Nov 20, 2019 at 18:29

1 Answer 1

Reset to default
-4

It is suggesting the call to free() would cause memory corruption, the application would crash, and open the system to a buffer overflow attack.

Improve this answer
1
  • 1
    This appears to just repeat the quoted text.
    – schroeder ♦
    Nov 23, 2019 at 20:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .