Memory Leak When Using Invalid Output Path in opj_compress

[shuangxiangkan]

Bug Description

A memory leak occurs in the OpenJPEG library when using an invalid output path with the opj_compress tool.

Steps to Reproduce

git clone https://github.com/uclouvain/openjpeg.git
cd openjpeg
cmake . -DCMAKE_BUILD_TYPE=Debug \
-DCMAKE_C_COMPILER=clang \
-DCMAKE_CXX_COMPILER=clang++ \
-DCMAKE_C_FLAGS="-fsanitize=address" \
-DCMAKE_CXX_FLAGS="-fsanitize=address"
make -j20

./bin/opj_compress -i /poc -o /dev/null/test.jp2

Environment

openjpeg version: v2.5.2.
ubuntu:22.04
clang version 16.0.0
afl-fuzz++4.22a

PoC

poc_memory-leak.zip

Detailed Leak Information

==1945884==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 192 byte(s) in 1 object(s) allocated from:
    #0 0x55dc22bed398 in __interceptor_calloc (/srv/scratch/PAG/ksx/Fuzz/Library/openjpeg-latest/build/bin/opj_compress+0xb3398) (BuildId: e5c3b44a27fcdc399f672c02ec39914473509198)
    #1 0x7ff9a40abdf2 in opj_create_compress /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/openjpeg.c:661:37

Direct leak of 48 byte(s) in 1 object(s) allocated from:
    #0 0x55dc22bed398 in __interceptor_calloc (/srv/scratch/PAG/ksx/Fuzz/Library/openjpeg-latest/build/bin/opj_compress+0xb3398) (BuildId: e5c3b44a27fcdc399f672c02ec39914473509198)
    #1 0x7ff9a403d322 in opj_image_create /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/image.c:46:28

Indirect leak of 706000 byte(s) in 1 object(s) allocated from:
    #0 0x55dc22bedd17 in posix_memalign (/srv/scratch/PAG/ksx/Fuzz/Library/openjpeg-latest/build/bin/opj_compress+0xb3d17) (BuildId: e5c3b44a27fcdc399f672c02ec39914473509198)
    #1 0x7ff9a4151ab0 in opj_aligned_alloc_n /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/opj_malloc.c:61:9
    #2 0x7ff9a4151ab0 in opj_aligned_malloc /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/opj_malloc.c:209:12
    #3 0x7ff9a403d5bc in opj_image_create /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/image.c:76:39

Indirect leak of 5696 byte(s) in 1 object(s) allocated from:
    #0 0x55dc22bed398 in __interceptor_calloc (/srv/scratch/PAG/ksx/Fuzz/Library/openjpeg-latest/build/bin/opj_compress+0xb3398) (BuildId: e5c3b44a27fcdc399f672c02ec39914473509198)
    #1 0x7ff9a40455fa in opj_j2k_setup_encoder /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/j2k.c:8132:29
    #2 0x7ff9a40965b3 in opj_jp2_setup_encoder /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/jp2.c:1931:9

Indirect leak of 1080 byte(s) in 1 object(s) allocated from:
    #0 0x55dc22bed398 in __interceptor_calloc (/srv/scratch/PAG/ksx/Fuzz/Library/openjpeg-latest/build/bin/opj_compress+0xb3398) (BuildId: e5c3b44a27fcdc399f672c02ec39914473509198)
    #1 0x7ff9a4046288 in opj_j2k_setup_encoder /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/j2k.c:8211:36
    #2 0x7ff9a40965b3 in opj_jp2_setup_encoder /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/jp2.c:1931:9

Indirect leak of 1000 byte(s) in 1 object(s) allocated from:
    #0 0x55dc22bed1ae in __interceptor_malloc (/srv/scratch/PAG/ksx/Fuzz/Library/openjpeg-latest/build/bin/opj_compress+0xb31ae) (BuildId: e5c3b44a27fcdc399f672c02ec39914473509198)
    #1 0x7ff9a4042360 in opj_j2k_create_compress /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/j2k.c:6832:73

Indirect leak of 376 byte(s) in 1 object(s) allocated from:
    #0 0x55dc22bed398 in __interceptor_calloc (/srv/scratch/PAG/ksx/Fuzz/Library/openjpeg-latest/build/bin/opj_compress+0xb3398) (BuildId: e5c3b44a27fcdc399f672c02ec39914473509198)
    #1 0x7ff9a4042308 in opj_j2k_create_compress /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/j2k.c:6823:37

Indirect leak of 320 byte(s) in 4 object(s) allocated from:
    #0 0x55dc22bed398 in __interceptor_calloc (/srv/scratch/PAG/ksx/Fuzz/Library/openjpeg-latest/build/bin/opj_compress+0xb3398) (BuildId: e5c3b44a27fcdc399f672c02ec39914473509198)
    #1 0x7ff9a4151418 in opj_procedure_list_create /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/function_list.c:49:50

Indirect leak of 176 byte(s) in 1 object(s) allocated from:
    #0 0x55dc22bed398 in __interceptor_calloc (/srv/scratch/PAG/ksx/Fuzz/Library/openjpeg-latest/build/bin/opj_compress+0xb3398) (BuildId: e5c3b44a27fcdc399f672c02ec39914473509198)
    #1 0x7ff9a4099e02 in opj_jp2_create /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/jp2.c:3151:34

Indirect leak of 88 byte(s) in 1 object(s) allocated from:
    #0 0x55dc22bed398 in __interceptor_calloc (/srv/scratch/PAG/ksx/Fuzz/Library/openjpeg-latest/build/bin/opj_compress+0xb3398) (BuildId: e5c3b44a27fcdc399f672c02ec39914473509198)
    #1 0x7ff9a3ff705a in opj_thread_pool_create /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/thread.c:629:31
    #2 0x7ff9a404253e in opj_j2k_create_compress /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/j2k.c:6856:19

Indirect leak of 64 byte(s) in 1 object(s) allocated from:
    #0 0x55dc22bed398 in __interceptor_calloc (/srv/scratch/PAG/ksx/Fuzz/Library/openjpeg-latest/build/bin/opj_compress+0xb3398) (BuildId: e5c3b44a27fcdc399f672c02ec39914473509198)
    #1 0x7ff9a403d383 in opj_image_create /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/image.c:51:43

Indirect leak of 64 byte(s) in 4 object(s) allocated from:
    #0 0x55dc22bed398 in __interceptor_calloc (/srv/scratch/PAG/ksx/Fuzz/Library/openjpeg-latest/build/bin/opj_compress+0xb3398) (BuildId: e5c3b44a27fcdc399f672c02ec39914473509198)
    #1 0x7ff9a41513e0 in opj_procedure_list_create /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/function_list.c:42:68

Indirect leak of 34 byte(s) in 1 object(s) allocated from:
    #0 0x55dc22bed1ae in __interceptor_malloc (/srv/scratch/PAG/ksx/Fuzz/Library/openjpeg-latest/build/bin/opj_compress+0xb31ae) (BuildId: e5c3b44a27fcdc399f672c02ec39914473509198)
    #1 0x7ff9a4045019 in opj_j2k_setup_encoder /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/j2k.c:8031:30
    #2 0x7ff9a40965b3 in opj_jp2_setup_encoder /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/jp2.c:1931:9

Indirect leak of 16 byte(s) in 1 object(s) allocated from:
    #0 0x55dc22bed398 in __interceptor_calloc (/srv/scratch/PAG/ksx/Fuzz/Library/openjpeg-latest/build/bin/opj_compress+0xb3398) (BuildId: e5c3b44a27fcdc399f672c02ec39914473509198)
    #1 0x7ff9a3ff7148 in opj_tls_new /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/thread.c:511:25
    #2 0x7ff9a3ff7148 in opj_thread_pool_create /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/thread.c:636:19
    #3 0x7ff9a404253e in opj_j2k_create_compress /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/j2k.c:6856:19

Indirect leak of 12 byte(s) in 1 object(s) allocated from:
    #0 0x55dc22bed1ae in __interceptor_malloc (/srv/scratch/PAG/ksx/Fuzz/Library/openjpeg-latest/build/bin/opj_compress+0xb31ae) (BuildId: e5c3b44a27fcdc399f672c02ec39914473509198)
    #1 0x7ff9a40966a4 in opj_jp2_setup_encoder /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/jp2.c:1955:37

Indirect leak of 4 byte(s) in 1 object(s) allocated from:
    #0 0x55dc22bed1ae in __interceptor_malloc (/srv/scratch/PAG/ksx/Fuzz/Library/openjpeg-latest/build/bin/opj_compress+0xb31ae) (BuildId: e5c3b44a27fcdc399f672c02ec39914473509198)
    #1 0x7ff9a4096623 in opj_jp2_setup_encoder /srv/scratch/PAG/ksx/Fuzz/Library/openjpeg/src/lib/openjp2/jp2.c:1944:29

SUMMARY: AddressSanitizer: 715170 byte(s) leaked in 22 allocation(s).