#783 Unchecked jp2:cblkwidth=0 aborts in WriteJP2Image

[hyunjung]

In coders/jp2.c, WriteJP2Image walks jasper_enc_options and builds the JasPer option string (around lines 1516 to 1553).
jp2:rate is parsed with atof.
Everything else is copied through with MagickFormatString.

The size related entries in that table are cblkwidth, cblkheight, prcwidth, and prcheight (see jasper_enc_options near line 122).
Those four are not checked.

On JasPer 4.2.5:

  gm convert in.pnm -define jp2:cblkwidth=0 out.jp2

aborts in jpc_floorlog2 (assert x > 0).
Without the define, convert succeeds.
Newer JasPer rejects i <= 0 itself, so the assert is gone there, but GraphicsMagick still forwards bad sizes for those options.

Could WriteJP2Image reject n <= 0 for cblkwidth, cblkheight, prcwidth, and prcheight the same way it already special cases rate?

[Bob Friesenhahn]

This is an annoying problem. GraphicsMagick is passing the original string value as provided by the user. Thorough validation is hard. For example, "cblkheight" has a constraint in that it "Must be an integer power of two", and perhaps <= 0 is also not valid.

Do we know how Jasper behaves for other options which do not meet constraints? Perhaps some options are not rejected, but cause it to crash?

[hyunjung]