CVE-2020-35538: 
NixOS vulnerability analysis and mitigation

CVE-2020-35538 is a vulnerability discovered in libjpeg-turbo, where a crafted input file could cause a null pointer dereference in the jcopy_sample_rows() function when processed by the library (NVD, Ubuntu).

The vulnerability occurs specifically in the jcopy_sample_rows() function when processing certain crafted input files. The issue manifests as a null pointer dereference, which can lead to a program crash. The vulnerability was particularly problematic when using the merged (non-fancy) upsampling algorithms for processing 4:2:2 or 4:2:0 JPEG images, especially when setting cinfo.do_fancy_upsampling to FALSE (Debian).

When exploited, this vulnerability can cause the application processing JPEG images with libjpeg-turbo to crash due to the null pointer dereference, potentially leading to a denial of service condition (Rapid7).

The vulnerability can be triggered by processing specially crafted JPEG files, particularly when using specific image processing operations like jpeg_skip_scanlines(). The issue manifests when NULL is passed as the output array address in jcopy_sample_rows() (Github Issue).

The vulnerability has been fixed in multiple versions across different distributions. Debian has fixed the issue in versions 1:2.0.6-4 for bullseye, 1:2.1.5-2 for bookworm, and 1:2.1.5-3.1 for sid and trixie (Debian).