#176 CVE-2024-28584: NULL-check JPEG2000 image after opj_read_header

[Daniel Rosser]

Applies to FreeImage SVN trunk r1911 (also 3.19.0 [r1909]).

CVE-2024-28584 — NULL pointer dereference in J2KImageToFIBITMAP() when reading a malformed J2K/JP2 file.

opj_read_header() can return success while leaving *image NULL. PluginJ2K.cpp / PluginJP2.cpp then passed that pointer into opj_decode() and J2KImageToFIBITMAP(), which immediately dereferences image->numcomps.

This patch checks image after opj_read_header() in both loaders, and also guards J2KImageToFIBITMAP() itself.

This is FreeImage glue, not a bundled OpenJPEG bump.

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-28584

GitHub: https://github.com/danoli3/FreeImage/commit/9286f7f (PR https://github.com/danoli3/FreeImage/pull/53)

Apply from the FreeImage tree root:

patch -p0 < CVE-2024-28584.patch