OpenJPEG 2.3.0 has a NULL pointer dereference for red in the imagetopnm function of jp2/convert.c https://nvd.nist.gov/vuln/detail/CVE-2018-18088