{"action":"created","issue":{"url":"https://api.github.com/repos/uclouvain/openjpeg/issues/718","repository_url":"https://api.github.com/repos/uclouvain/openjpeg","labels_url":"https://api.github.com/repos/uclouvain/openjpeg/issues/718/labels{/name}","comments_url":"https://api.github.com/repos/uclouvain/openjpeg/issues/718/comments","events_url":"https://api.github.com/repos/uclouvain/openjpeg/issues/718/events","html_url":"https://github.com/uclouvain/openjpeg/issues/718","id":137771847,"number":718,"title":"fuzzing-created crashers","user":{"login":"setharnold","id":5447148,"avatar_url":"https://avatars.githubusercontent.com/u/5447148?v=3","gravatar_id":"","url":"https://api.github.com/users/setharnold","html_url":"https://github.com/setharnold","followers_url":"https://api.github.com/users/setharnold/followers","following_url":"https://api.github.com/users/setharnold/following{/other_user}","gists_url":"https://api.github.com/users/setharnold/gists{/gist_id}","starred_url":"https://api.github.com/users/setharnold/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/setharnold/subscriptions","organizations_url":"https://api.github.com/users/setharnold/orgs","repos_url":"https://api.github.com/users/setharnold/repos","events_url":"https://api.github.com/users/setharnold/events{/privacy}","received_events_url":"https://api.github.com/users/setharnold/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/uclouvain/openjpeg/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/uclouvain/openjpeg/labels/Priority-Critical","name":"Priority-Critical","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":20,"created_at":"2016-03-02T04:43:59Z","updated_at":"2016-04-23T12:52:54Z","closed_at":null,"body":"Hello; I reviewed OpenJPEG recently for the Ubuntu Linux distribution. As part of this effort I ran our currently packaged 1.5.2 version through the AFL fuzzer for roughly a day and found several issues. I verified that these specific crashing files do not crash the 2.1.0 upstream release, but four hours of fuzzing time found a crashing file on 2.1.0.\r\n\r\nI've uploaded the tarball of files that caused crashes to Launchpad:\r\nhttps://bugs.launchpad.net/ubuntu/+source/openjpeg/+bug/711061/+attachment/4586223/+files/openjpeg-crashers.tar.gz\r\nIf that URL doesn't work, the bug is at:\r\nhttps://bugs.launchpad.net/ubuntu/+source/openjpeg/+bug/711061\r\n\r\nPlease consider adding these files to your test suite.\r\n\r\nWhen you've had an opportunity to diagnose and prepare fixes, it would be hugely beneficial to downstream consumers if you could also request CVEs on the oss-security mail list:\r\nhttp://oss-security.openwall.org/wiki/mailing-lists/oss-security\r\n\r\nI would be happy to help request CVEs when you're ready.\r\n\r\nThanks"},"comment":{"url":"https://api.github.com/repos/uclouvain/openjpeg/issues/comments/213735795","html_url":"https://github.com/uclouvain/openjpeg/issues/718#issuecomment-213735795","issue_url":"https://api.github.com/repos/uclouvain/openjpeg/issues/718","id":213735795,"user":{"login":"boxerab","id":95393,"avatar_url":"https://avatars.githubusercontent.com/u/95393?v=3","gravatar_id":"","url":"https://api.github.com/users/boxerab","html_url":"https://github.com/boxerab","followers_url":"https://api.github.com/users/boxerab/followers","following_url":"https://api.github.com/users/boxerab/following{/other_user}","gists_url":"https://api.github.com/users/boxerab/gists{/gist_id}","starred_url":"https://api.github.com/users/boxerab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/boxerab/subscriptions","organizations_url":"https://api.github.com/users/boxerab/orgs","repos_url":"https://api.github.com/users/boxerab/repos","events_url":"https://api.github.com/users/boxerab/events{/privacy}","received_events_url":"https://api.github.com/users/boxerab/received_events","type":"User","site_admin":false},"created_at":"2016-04-23T12:52:54Z","updated_at":"2016-04-23T12:52:54Z","body":"@malaterre  thanks for this tip : turns out I do need `-lubsan`  in the shared linker flags in order\r\nto compile dynamic build.  Putting in `-fsanitize=undefined` didn't work. "}}