djvulibre_mmr_exploit

This project provides a minimal C++ implementation that triggers a known heap out-of-bounds write vulnerability in DjVuLibre. The code does not weaponize the bug; it only reproduces the faulty execution path so the issue can be inspected and understood.

The vulnerability originates in the parser for MMR-encoded image chunks. During processing, the MMRDecoder::scanruns function decodes horizontal runs into a line buffer without performing sufficient bounds checking. Using consecutive 0-length horizontal runs, you can cause a buffer overflow, leading to an OOB-write.

This implementation was developed as part of the final project for the Network Security course at National Yang Ming Chiao Tung University (NYCU) in Hsinchu, Taiwan. The focus is on understanding how parsing logic, unchecked buffer assumptions, and malformed image data can combine to produce memory-safety failures in real-world libraries.

Building and installing

See the BUILDING document.

Contributing

See the CONTRIBUTING document.

Licensing