pal2rgb allocate output buffer to convert TIFF format. The output buffer always
uses a fixed size(225).  However, when write data to output buffer, imagewidth
and imagelength of the input TIFF file are used. it lead to heap overflow.

1) get imagewidth and imagelength from input TIFF

tools/pal2rgb.c:142     TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &imagewidth);
tools/pal2rgb.c:143     TIFFGetField(in, TIFFTAG_IMAGELENGTH, &imagelength);

2) allocate output buffer
tools/pal2rgb.c:188       obuf = (unsigned
char*)_TIFFmalloc(TIFFScanlineSize(out)); // TIFFScanlineSize(out) returns
always 225.

3) write data to output buffer
tools/pal2rgb.c:191         for (row = 0; row < imagelength; row++) {
tools/pal2rgb.c:192             if (!TIFFReadScanline(in, ibuf, row, 0))
tools/pal2rgb.c:193                 goto done;
tools/pal2rgb.c:194             pp = obuf;
tools/pal2rgb.c:195             for (x = 0; x < imagewidth; x++) { // HEAP
OVERFLOW!
tools/pal2rgb.c:196                 *pp++ = (unsigned char) rmap[ibuf[x]];
tools/pal2rgb.c:197                 *pp++ = (unsigned char) gmap[ibuf[x]];
tools/pal2rgb.c:198                 *pp++ = (unsigned char) bmap[ibuf[x]];
tools/pal2rgb.c:199             }
tools/pal2rgb.c:200             if (!TIFFWriteScanline(out, obuf, row, 0)) //
CRASH!
tools/pal2rgb.c:201                 goto done;
tools/pal2rgb.c:202         }

Created an attachment (id=819) [details]
heap overflow PoC

The process's heap memory was corrupted by COLORMAP/mage Width/Image Length of
the TIFF document. The offset of the corresponding values in the poc.tiff file
is shown below.

COLORMAP {
    R : 0x25~0x224
    G : 0x225~0x424
    B : 0x425~0x624
}

Image Width : 0x24FE
Image Length : 0x250A

The following change fixes the describe behavior:

diff --git a/tools/pal2rgb.c b/tools/pal2rgb.c
index 7a57800..92d9e29 100644
--- a/tools/pal2rgb.c
+++ b/tools/pal2rgb.c
@@ -184,15 +184,17 @@ main(int argc, char* argv[])
     { unsigned char *ibuf, *obuf;
       register unsigned char* pp;
       register uint32 x;
-      ibuf = (unsigned char*)_TIFFmalloc(TIFFScanlineSize(in));
-      obuf = (unsigned char*)_TIFFmalloc(TIFFScanlineSize(out));
+      size_t ibuf_size = TIFFScanlineSize(in);
+      size_t obuf_size = TIFFScanlineSize(out);
+      ibuf = (unsigned char*)_TIFFmalloc(ibuf_size);
+      obuf = (unsigned char*)_TIFFmalloc(obuf_size);
       switch (config) {
       case PLANARCONFIG_CONTIG:
         for (row = 0; row < imagelength; row++) {
             if (!TIFFReadScanline(in, ibuf, row, 0))
                 goto done;
             pp = obuf;
-            for (x = 0; x < imagewidth; x++) {
+            for (x = 0; x < imagewidth && x < (obuf_size-3); x++) {
                 *pp++ = (unsigned char) rmap[ibuf[x]];
                 *pp++ = (unsigned char) gmap[ibuf[x]];
                 *pp++ = (unsigned char) bmap[ibuf[x]];
@@ -205,15 +207,15 @@ main(int argc, char* argv[])
         for (row = 0; row < imagelength; row++) {
             if (!TIFFReadScanline(in, ibuf, row, 0))
                 goto done;
-            for (pp = obuf, x = 0; x < imagewidth; x++)
+            for (pp = obuf, x = 0; x < imagewidth && x < obuf_size; x++)
                 *pp++ = (unsigned char) rmap[ibuf[x]];
             if (!TIFFWriteScanline(out, obuf, row, 0))
                 goto done;
-            for (pp = obuf, x = 0; x < imagewidth; x++)
+            for (pp = obuf, x = 0; x < imagewidth && x < obuf_size; x++)
                 *pp++ = (unsigned char) gmap[ibuf[x]];
             if (!TIFFWriteScanline(out, obuf, row, 0))
                 goto done;
-            for (pp = obuf, x = 0; x < imagewidth; x++)
+            for (pp = obuf, x = 0; x < imagewidth && x < obuf_size; x++)
                 *pp++ = (unsigned char) bmap[ibuf[x]];
             if (!TIFFWriteScanline(out, obuf, row, 0))
                 goto done;


But the pal2rgb stil segfaults. new backtrace:

Core was generated by `pal2rgb /home/ncopa/Downloads/poc.tiff out.tiff'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000065eb6f74f534 in jpeg_abort () from /usr/lib/libjpeg.so.8
(gdb) bt
#0  0x000065eb6f74f534 in jpeg_abort () from /usr/lib/libjpeg.so.8
#1  0x000065eb6f9c26b7 in TIFFjpeg_abort (sp=sp@entry=0xdbd8738e7c0)
    at tif_jpeg.c:416
#2  0x000065eb6f9c3f8c in JPEGPreDecode (tif=0x65eb6fc06900, s=<optimized out>)
    at tif_jpeg.c:1114
#3  0x000065eb6f9d4305 in TIFFSeek (sample=0, row=54, tif=0x65eb6fc06900)
    at tif_read.c:379
#4  TIFFReadScanline (tif=0x65eb6fc06900, buf=0xdbd8738ef40, row=54, 
    sample=<optimized out>) at tif_read.c:446
#5  0x00000dbd8718c5fc in main (argc=<optimized out>, argv=<optimized out>)
    at pal2rgb.c:194

OK, so I don't know anything about TIFF, but reading the code it's apparent
that pal2rgb expects the output buffer to be 3x the size of the input buffer
(presumably it's taking an array of colors which are indices into a palette and
exploding them out into RGB tuples). For whatever reason, when given the POC
image it does not create an output buffer of the correct size.

Here's a patch that will detect the problem and reject the image:

diff --git a/tools/pal2rgb.c b/tools/pal2rgb.c
index 0423598f..4eb5e86f 100644
--- a/tools/pal2rgb.c
+++ b/tools/pal2rgb.c
@@ -182,8 +182,19 @@ main(int argc, char* argv[])
        { unsigned char *ibuf, *obuf;
          register unsigned char* pp;
          register uint32 x;
-         ibuf = (unsigned char*)_TIFFmalloc(TIFFScanlineSize(in));
-         obuf = (unsigned char*)_TIFFmalloc(TIFFScanlineSize(out));
+      uint64_t tss_in = TIFFScanlineSize(in);
+      uint64_t tss_out = TIFFScanlineSize(out);
+      if (tss_out / tss_in < 3) {
+          /*
+           * BUG 2750: The following code assumes the output buffer is 3x the
+           * length of the input buffer due to exploding the palette into
+           * RGB tuples. If this doesn't happen, fail now.
+           */
+          fprintf(stderr, "Could not determine correct image size for output.
Exiting.\n");
+          return -1;
+      }
+         ibuf = (unsigned char*)_TIFFmalloc(tss_in);
+         obuf = (unsigned char*)_TIFFmalloc(tss_out);
          switch (config) {
          case PLANARCONFIG_CONTIG:
                for (row = 0; row < imagelength; row++) {

Question is, why TIFFScanlineSize(out) returns less than 3*imagewidth, as the
rest of pal2rgb assume.

Breakpoint 2, main (argc=3, argv=0x7fffffffe8a8) at pal2rgb.c:187
187          ibuf = (unsigned char*)_TIFFmalloc(TIFFScanlineSize(in));
(gdb) call TIFFScanlineSize(in)
$7 = 150
(gdb) n
188          obuf = (unsigned char*)_TIFFmalloc(TIFFScanlineSize(out));
(gdb) call TIFFScanlineSize(out)
$8 = 225
(gdb)

Following code has the influence, because TIFFScanlineSize() value depends on
photometric content (TIFFTAG_PHOTOMETRIC):

        case COMPRESSION_JPEG:
                if (jpegcolormode == JPEGCOLORMODE_RGB)
                        photometric = PHOTOMETRIC_YCBCR;
                else
                        photometric = PHOTOMETRIC_RGB;
                TIFFSetField(out, TIFFTAG_JPEGQUALITY, quality);
                TIFFSetField(out, TIFFTAG_JPEGCOLORMODE, jpegcolormode);
                break;

When photometric is set to PHOTOMETRIC_YCBCR, the value of
TIFFScanlineSize(out) is 225 in this case. While set to PHOTOMETRIC_RGB, the
value is TIFFScanlineSize(out) is then 450, i. e. 3*TIFFScanlineSize(in), which
would suffice.

Bugzilla is no longer used for tracking libtiff issues. Remaining open tickets,
such as this one, have been migrated to the libtiff GitLab instance at
https://gitlab.com/libtiff/libtiff/issues .

The migrated tickets have their summary prefixed with [BZ#XXXX] where XXXX is
the initial Bugzilla issue number.