Accusoft ImageGear JPEG-JFIF Scan header parser out-of-bounds write vulnerability
We discussed this vulnerability during Episode 124 on 01 March 2022
There is an out-of-bounds access that comes because of a difference between parsing the huffman tables vs using the huffman tables. While parsing the table, the function ensures that each identifier can only be between 0 and 3. Later on when parsing the element indices into the huffman tables it uses 4bit wide variaibles, or a range of 0-15. Leading to out-of-bounds access.