[BZ#2852] There is a heap-buffer-overflow in libtiff 4.0.10 in tif_unix.c:346

Submitted by xiaosatianyu at 126 dot com on 2019-04-28 10:08

Description

Created an attachment (id=895)
There is a heap-buffer-overflow in libtiff 4.0.10 in tif_unix.c:346

tiff -i file /dev/null
There is a heap-buffer-overflow in libtiff 4.0.10 in tif_unix.c:346

==25672==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000150 at pc 0x0000004ac057 bp 0x7ffc45c9bb80 sp 0x7ffc45c9b330
READ of size 131072 at 0x603000000150 thread T0
    #0 0x4ac056 in __asan_memcpy /scratch/llvm/clang-4/xenial/final/llvm.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:453:3
    #1 0x7f4fa0af4e14 in _TIFFmemcpy /home/digger/afl-adapative/env/libtiff/tiff-4.0.10-afl/libtiff/tif_unix.c:346:2
    #2 0x7f4fa09fa449 in TIFFWriteDirectoryTagColormap /home/digger/afl-adapative/env/libtiff/tiff-4.0.10-afl/libtiff/tif_dirwrite.c:1863:2
    #3 0x7f4fa09f00d1 in TIFFWriteDirectorySec /home/digger/afl-adapative/env/libtiff/tiff-4.0.10-afl/libtiff/tif_dirwrite.c:567:10
    #4 0x7f4fa09edcef in TIFFWriteDirectory /home/digger/afl-adapative/env/libtiff/tiff-4.0.10-afl/libtiff/tif_dirwrite.c:182:9
    #5 0x7f4fa09f55a0 in TIFFRewriteDirectory /home/digger/afl-adapative/env/libtiff/tiff-4.0.10-afl/libtiff/tif_dirwrite.c:222:10
    #6 0x7f4fa0a22406 in TIFFFlush /home/digger/afl-adapative/env/libtiff/tiff-4.0.10-afl/libtiff/tif_flush.c:81:13
    #7 0x7f4fa098f89b in TIFFCleanup /home/digger/afl-adapative/env/libtiff/tiff-4.0.10-afl/libtiff/tif_close.c:51:3
    #8 0x7f4fa0990262 in TIFFClose /home/digger/afl-adapative/env/libtiff/tiff-4.0.10-afl/libtiff/tif_close.c:126:2
    #9 0x4f00c3 in main /home/digger/afl-adapative/env/libtiff/tiff-4.0.10-afl/tools/tiffcp.c:303:12
    #10 0x7f4f9f0f9b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #11 0x41b719 in _start (/home/digger/afl-adapative/env/libtiff/install-asan/bin/tiffcp+0x41b719)

0x603000000150 is located 0 bytes to the right of 32-byte region [0x603000000130,0x603000000150)
allocated by thread T0 here:
    #0 0x4c241c in malloc /scratch/llvm/clang-4/xenial/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:66:3
    #1 0x7f4fa0af4cfc in _TIFFmalloc /home/digger/afl-adapative/env/libtiff/tiff-4.0.10-afl/libtiff/tif_unix.c:314:10
    #2 0x7f4fa0996edd in setByteArray /home/digger/afl-adapative/env/libtiff/tiff-4.0.10-afl/libtiff/tif_dir.c:52:19
    #3 0x7f4fa0997026 in _TIFFsetShortArray /home/digger/afl-adapative/env/libtiff/tiff-4.0.10-afl/libtiff/tif_dir.c:64:7
    #4 0x7f4fa099fa73 in _TIFFVSetField /home/digger/afl-adapative/env/libtiff/tiff-4.0.10-afl/libtiff/tif_dir.c:359:3
    #5 0x7f4fa0a723bd in LogLuvVSetField /home/digger/afl-adapative/env/libtiff/tiff-4.0.10-afl/libtiff/tif_luv.c:1673:10
    #6 0x7f4fa09973f6 in TIFFVSetField /home/digger/afl-adapative/env/libtiff/tiff-4.0.10-afl/libtiff/tif_dir.c:852:6
    #7 0x7f4fa099731b in TIFFSetField /home/digger/afl-adapative/env/libtiff/tiff-4.0.10-afl/libtiff/tif_dir.c:796:11
    #8 0x4f3a3e in cpTag /home/digger/afl-adapative/env/libtiff/tiff-4.0.10-afl/tools/tiffcp.c:506:4
    #9 0x4f1cf7 in tiffcp /home/digger/afl-adapative/env/libtiff/tiff-4.0.10-afl/tools/tiffcp.c:725:2
    #10 0x4f008d in main /home/digger/afl-adapative/env/libtiff/tiff-4.0.10-afl/tools/tiffcp.c:301:9
    #11 0x7f4f9f0f9b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)

SUMMARY: AddressSanitizer: heap-buffer-overflow /scratch/llvm/clang-4/xenial/final/llvm.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:453:3 in __asan_memcpy
Shadow bytes around the buggy address:
  0x0c067fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c067fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c067fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c067fff8000: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
  0x0c067fff8010: fd fa fa fa fd fd fd fd fa fa fd fd fd fd fa fa
=>0x0c067fff8020: fd fd fd fd fa fa 00 00 00 00[fa]fa 00 00 00 00
  0x0c067fff8030: fa fa 00 00 00 00 fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==25672==ABORTING
Attachment 895, "There is a heap-buffer-overflow in libtiff 4.0.10 in tif_unix.c:346":
id_000018-sig_11-src_003500+002715-op_splice-rep_2