CVE-2018-16376: An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the...

The vulnerability description and the linked GitHub issue (#1127) directly point to the t2_encode_packet function in lib/openmj2/t2.c (or src/lib/openmj2/t2.c). The issue details the exact locations within the function where buffer length checks were missing, leading to potential out-of-bounds writes. The proposed patch in the issue clearly shows the addition of these missing checks. Although direct commit information could not be fetched, the evidence from the issue is strong and specific. The function opj_t2_encode_packet is also mentioned in the error messages within the proposed patch, indicating it's the public-facing or higher-level function that calls the vulnerable code, or is the same function (OpenJPEG uses opj_ prefix for its public API). Given the context, t2_encode_packet is the core vulnerable routine, and opj_t2_encode_packet would likely be seen in a higher-level stack trace if the error is propagated or if it's an alias/wrapper for t2_encode_packet itself within the library's API structure. Since the vulnerability is in t2_encode_packet, that's the primary vulnerable function. The error message opj_event_msg(p_manager, EVT_ERROR, \"opj_t2_encode_packet(): only %u bytes remaining in \"... confirms opj_t2_encode_packet is the function name as it would appear in logs or error reports, and is likely the one exposed through the library's API, making it a key runtime indicator. However, the actual buffer overflow happens inside the logic of t2_encode_packet as described in the issue. For the purpose of identifying the function containing the vulnerability, t2_encode_packet is the most precise answer based on the provided diff in the issue. The NVD description also explicitly names t2_encode_packet.