Executive brief
jpeg-js is a JavaScript library for decoding JPEG images. A malformed JPEG file can trigger an infinite loop in the decoder, causing the application to hang and become unresponsive, leading to a denial of service. This affects any application using this library to process untrusted image data.
Technical details
The vulnerability is a CWE-835 infinite loop caused by uninitialized loop control variables. When a JPEG file contains no components in the frame data, the variables maxH and maxV remain at their initial value of zero. This causes division by zero in the calculation of mcusPerLine and mcusPerColumn, setting them to Infinity. In the subsequent decodeAsScan() function, the loop condition (mcu < mcuExpected, where mcuExpected = Infinity × Infinity) never evaluates to false, resulting in an infinite loop. The vulnerability requires only network-level attack vector—an attacker can trigger it by providing a specially crafted JPEG file. The fix is available in version 0.4.4 and later.
Affected products
- jpeg-js jpeg-js before 0.4.4
Timeline
- 2022-06-02: disclosed: Issue reported on GitHub
- 2022-06-10: advisory: NVD published
- 2022-06-11: advisory: GHSA advisory published
- 2022-06-17: patched: Fix available in version 0.4.4