BF Specification of CVE-2015-5221 Use-after-free in JasPer JPEG-2000 before 1.900.2

//generated// Erroneous Code (in 'mif_process_cmpt()') to Standard Library Deallocate (src/libjasper/mif/mif_cod.c) in leads to Dangling Pointer ('tvp')

, which propagates to Dangling Pointer (in ‘xxx’) Direct Read Standard Library (xxx) in resulting in Use After Deallocate

. If exploited this can lead to DOS (availability loss).

vendor:product: fedoraproject:fedora

Bug Report

Code with Bug

Code with Fix

NVD Entry

MMNMemory Management (MMN) class – An object is allocated, deallocated, or resized improperly.
MUSMemory Use (MUS) class – An object is initialized, read, written, or cleared improperly.
DeallocateDeallocate operation – Release the allocated memory of an object.
ReadRead operation – Use the value of an object's data.
Code BugCode Bug type – Defect in the implementation of the operation – proper operands over an improper operation. A first cause for the chain of weaknesses underlying a software security vulnerability. Must be fixed to resolve the vulnerability.
   Erroneous CodeErroneous Code bug - There is a coding error in the implementation of the operation.
Address Error/FaultAddress Fault/Error type – The object address in use is wrong.
   Dangling PointerDangling Pointer fault/error – Still holds the address of its successfully deallocated object (e.g., pointer to a freed heap object or with a returned by a function stack object address).
Memory Corruption/Disclosure Final ErrorMemory Corruption/Disclosure exploitable error type – An exploitable or undefined system behavior caused by memory addressing, allocation, use, and deallocation bugs.
   Use After DeallocateUse After Deallocate (Use After Free/Return) exploitable error – An attempt to use (dereference, read, write, or clear) a deallocated object (e.g., a freed heap object -- Use After Free) or out of scope object (e.g., returned by a function address of a stack object -- Use After Return).
Operation AttributeDefinition
Source CodeSource Code operation attribute type – Shows where the buggy/faulty operation code is in software or firmware.
   Standard LibraryStandard Library operation attribute – The operation code is in the standard library for a particular programming language.
MechanismMechanism operation attribute type – Shows how the buggy/faulty operation code is performed.
   DirectDirect operation attribute – The operation is on a particular object element.
Operand AttributeDefinition