You need to log in before you can comment on or make changes to this bug.
Created an attachment (id=766) [details] testcase on libtiff 4.0.7 The combineSeparateSamples24bits function in tiffcrop.c:4021 allows remote attackers to cause a denial of service (heap buffer overflow) via a crafted file. #tiffcrop $FILE out.tif ================================================================= ==72026==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62000000fff4 at pc 0x000000410c4b bp 0x7ffe43d35e30 sp 0x7ffe43d35e28 READ of size 1 at 0x62000000fff4 thread T0 #0 0x410c4a in combineSeparateSamples24bits /home/haojun/Downloads/testopensourcecode/tiff-4.0.7/tools/tiffcrop.c:4021 #1 0x4157c8 in readSeparateStripsIntoBuffer /home/haojun/Downloads/testopensourcecode/tiff-4.0.7/tools/tiffcrop.c:4889 #2 0x41ebcb in loadImage /home/haojun/Downloads/testopensourcecode/tiff-4.0.7/tools/tiffcrop.c:6175 #3 0x40a743 in main /home/haojun/Downloads/testopensourcecode/tiff-4.0.7/tools/tiffcrop.c:2345 #4 0x7f730b2ffb34 in __libc_start_main (/lib64/libc.so.6+0x21b34) #5 0x402e28 (/home/haojun/Downloads/testopensourcecode/tiff-4.0.7_build/bin/tiffcrop+0x402e28) 0x62000000fff4 is located 0 bytes to the right of 3956-byte region [0x62000000f080,0x62000000fff4) allocated by thread T0 here: #0 0x7f730c0f3bb8 in __interceptor_malloc ../../../../libsanitizer/asan/asan_malloc_linux.cc:62 #1 0x486286 in _TIFFmalloc /home/haojun/Downloads/testopensourcecode/tiff-4.0.7/libtiff/tif_unix.c:316 #2 0x4150a2 in readSeparateStripsIntoBuffer /home/haojun/Downloads/testopensourcecode/tiff-4.0.7/tools/tiffcrop.c:4821 #3 0x41ebcb in loadImage /home/haojun/Downloads/testopensourcecode/tiff-4.0.7/tools/tiffcrop.c:6175 #4 0x40a743 in main /home/haojun/Downloads/testopensourcecode/tiff-4.0.7/tools/tiffcrop.c:2345 #5 0x7f730b2ffb34 in __libc_start_main (/lib64/libc.so.6+0x21b34) SUMMARY: AddressSanitizer: heap-buffer-overflow /home/haojun/Downloads/testopensourcecode/tiff-4.0.7/tools/tiffcrop.c:4021 in combineSeparateSamples24bits Shadow bytes around the buggy address: 0x0c407fff9fa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c407fff9fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c407fff9fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c407fff9fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c407fff9fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c407fff9ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[04]fa 0x0c407fffa000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c407fffa010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c407fffa020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c407fffa030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c407fffa040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==72026==ABORTING testcase:https://github.com/bestshow/p0cs/blob/master/heap-buffer-overflow-combineSeparateSamples24bits-tiffcrop-2.tif
Bugzilla is no longer used for tracking libtiff issues. Remaining open tickets, such as this one, have been migrated to the libtiff GitLab instance at https://gitlab.com/libtiff/libtiff/issues . The migrated tickets have their summary prefixed with [BZ#XXXX] where XXXX is the initial Bugzilla issue number.
