Memory leak in jas_iccprof_createfrombuf function in JasPer 1.900.1 and earlier was found, allowing remote attackers to cause a denial of service (memory consumption) via a crafted ICC color profile in a JPEG 2000 image file.

Vulnerable code:

src/libjasper/base/jas_icc.c:
1685    jas_iccprof_t *jas_iccprof_createfrombuf(uchar *buf, int len)
1686    {
1687            jas_stream_t *in;
1688            jas_iccprof_t *prof;
1689            if (!(in = jas_stream_memopen(JAS_CAST(char *, buf), len)))
1690                    goto error;
1691            if (!(prof = jas_iccprof_load(in)))
1692                    goto error;
1693            jas_stream_close(in);
1694            return prof;
1695    error:
1696            return 0;
1697    }

jas_stream_t allocated by the call to jas_stream_memopen() is leaked if jas_iccprof_load() fails on line 1691.

Proposed patch:

http://seclists.org/oss-sec/2016/q1/att-507/CVE-2016-2116.patch

Public via (contains crash report):

http://seclists.org/oss-sec/2016/q1/507