Bug 2652 - NULL pointer dereference in tif_unix.c
: NULL pointer dereference in tif_unix.c
Status: RESOLVED LATER
: libtiff
default
: unspecified
: PC Linux
: P1 critical
: ---
Assigned To:
:
:
: migrated_to_gitlab
:
:
  Show dependency treegraph
 
Reported: 2017-01-04 10:26 by
Modified: 2019-10-01 14:20 (History)


Attachments
stacktrace (164 bytes, text/plain)
2017-01-04 10:26, Agostino Sarubbo
Details


Note

You need to log in before you can comment on or make changes to this bug.


Description From 2017-01-04 10:26:06
Created an attachment (id=738) [details]
stacktrace

On 4.0.7, with the undefined behavior sanitizer (-fsanitize=undefined):

tiffcp -i $FILE /tmp/foo

runtime error: null pointer passed as argument 2, which is declared to never be
null


Testcase:
https://github.com/asarubbo/poc/blob/master/00122-libtiff-nullptr-tif_unix

FTR: it is confirmed on master
------- Comment #1 From 2017-01-11 07:54:11 -------
I hit an assertion in TIFFWriteDirectoryTagCheckedRational(), which is now
fixed per //bugzilla.maptools.org/show_bug.cgi?id=2535

With HEAD, I do not get the error you got :
{{{
TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not
sorted in ascending order.
00122-libtiff-nullptr-tif_unix: Warning, Nonstandard tile length 3, convert
file.
TIFFReadDirectory: Warning, Unknown field with tag 45489 (0xb1b1) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 40448 (0x9e00) encountered.
TIFFFetchNormalTag: Warning, IO error during reading of "DocumentName"; tag
ignored.
TIFFFetchNormalTag: Warning, Sanity check on size of "Tag 40448" value failed;
tag ignored.
LZWPreDecode: Warning, Old-style LZW codes, convert file.
LZWDecodeCompat: Warning, LZWDecode: Strip -1 not terminated with EOI code.
LZWDecodeCompat: Not enough data at scanline 0 (short 10 bytes).
TIFFFillTile: 0: Invalid tile byte count, tile 1.
TIFFFetchDirectory: Can not read TIFF directory count.
TIFFReadDirectory: Failed to read directory at offset 7595146281608243560.
}}}
------- Comment #2 From 2017-01-17 08:58:43 -------
With Head, I still get the failure:

/tmp/portage/media-libs/tiff-9999/work/tiff-9999/libtiff/tif_unix.c:348:12:
runtime error: null pointer passed as argument 2, which is declared to never be
null
------- Comment #3 From 2019-10-01 14:20:14 -------
Bugzilla is no longer used for tracking libtiff issues. Remaining open tickets,
such as this one, have been migrated to the libtiff GitLab instance at
https://gitlab.com/libtiff/libtiff/issues .

The migrated tickets have their summary prefixed with [BZ#XXXX] where XXXX is
the initial Bugzilla issue number.