Bug 2839 – Divide by zero in raw2tiff.c

Bug 2839 - Divide by zero in raw2tiff.c

Summary:

Divide by zero in raw2tiff.c

Status:	RESOLVED LATER

Product:	libtiff
Component:	default
Version:	unspecified
Platform:	PC Linux

Importance:	P2 critical
Target Milestone:	---
Assigned To:	Frank Warmerdam

URL:
Whiteboard:
Keywords:	migrated_to_gitlab

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2019-01-23 02:10 by Ridwan Shariffdeen
Modified:	2019-10-01 14:21 (History)

Attachments
proposed fix for raw2tiff.c (2.68 KB, patch) 2019-02-11 16:30, Thomas Bernard	Details \| Diff
Add an attachment (proposed patch, testcase, etc.)

Note

You need to log in before you can comment on or make changes to this bug.

Description From Ridwan Shariffdeen 2019-01-23 02:10:48

stacktrace

On 4.0.9, with -fsanitize=undefined:

raw2tiff $FILE out.tiff

Image width and height are not specified.
raw2tiff.c:568:29: runtime error: division by zero
read error.

PoC:
https://github.com/rshariffdeen/poc/blob/master/0001-libtiff-dividebyzero-rawtiff

------- Comment #1 From Thomas Bernard 2019-01-28 10:31:36 -------

(In reply to comment #0)
> stacktrace
> 
> On 4.0.9, with -fsanitize=undefined:

Does it happen with 4.0.10 ?

------- Comment #2 From Ridwan Shariffdeen 2019-01-28 20:59:40 -------

Yes verified on 4.0.10 as well

------- Comment #3 From Thomas Bernard 2019-02-11 16:19:58 -------

OK, I think there may indeed be a bug in raw2tiff.c in the code to guess the
image dimensions guessSize()

It calculates the correlation between two guessed scanlines. But if both are
only 0's, correlation() results in Nan (and involves a divide by 0)

I think before calling correlation() it should do a memcmp() to check if both
scanlines are equals...

And anyway any full 0 line trigger a divide by 0

------- Comment #4 From Thomas Bernard 2019-02-11 16:30:35 -------

Created an attachment (id=889) [details]
proposed fix for raw2tiff.c

------- Comment #5 From Ridwan Shariffdeen 2019-02-11 17:33:58 -------

can I request for a CVE ID for this bug?

------- Comment #6 From Even Rouault 2019-10-01 14:21:27 -------

Bugzilla is no longer used for tracking libtiff issues. Remaining open tickets,
such as this one, have been migrated to the libtiff GitLab instance at
https://gitlab.com/libtiff/libtiff/issues .

The migrated tickets have their summary prefixed with [BZ#XXXX] where XXXX is
the initial Bugzilla issue number.