Heap buffer overflow in reverseSamples8bits, tiffcrop.c:8734

Summary

There is a heap buffer overflow in tiffcrop, reverseSamples8bits. tiffcrop.c:8734, which could lead to denial of service.

Version

LIBTIFF, Version 4.3.0, commit 2a7f438d

Steps to reproduce

Compile with flag

-O0 -g -fsanitize=address

Run

./tiffcrop -i poc /dev/null

Here is the trace reported by ASAN:

==182439==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61c000000754 at pc 0x00000052485e bp 0x7ffe2ebb66e0 sp 0x7ffe2ebb66d8
 READ of size 1 at 0x61c000000754 thread T0
     #0 0x52485d in reverseSamples8bits /mnt/data/playground/libtiff/build-bug/tools/../../tools/tiffcrop.c:8734:17
     #1 0x52485d in rotateImage /mnt/data/playground/libtiff/build-bug/tools/../../tools/tiffcrop.c:8495:35
     #2 0x4fcf02 in correct_orientation /mnt/data/playground/libtiff/build-bug/tools/../../tools/tiffcrop.c:6316:9
     #3 0x4fcf02 in main /mnt/data/playground/libtiff/build-bug/tools/../../tools/tiffcrop.c:2386:6
     #4 0x7f24d5d2c83f in __libc_start_main /build/glibc-S7Ft5T/glibc-2.23/csu/../csu/libc-start.c:291
     #5 0x41c828 in _start (/mnt/data/playground/libtiff/build-bug/tools/tiffcrop+0x41c828)
 
 0x61c000000754 is located 5 bytes to the right of 1743-byte region [0x61c000000080,0x61c00000074f)
 allocated by thread T0 here:
     #0 0x4afc22 in malloc /dependence/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145
     #1 0x5bf734 in _TIFFmalloc /mnt/data/playground/libtiff/build-bug/libtiff/../../libtiff/tif_unix.c:314:10
     #2 0x4fca92 in main /mnt/data/playground/libtiff/build-bug/tools/../../tools/tiffcrop.c:2376:11
     #3 0x7f24d5d2c83f in __libc_start_main /build/glibc-S7Ft5T/glibc-2.23/csu/../csu/libc-start.c:291
 
 SUMMARY: AddressSanitizer: heap-buffer-overflow /mnt/data/playground/libtiff/build-bug/tools/../../tools/tiffcrop.c:8734:17 in reverseSamples8bits
 Shadow bytes around the buggy address:
   0x0c387fff8090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c387fff80a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c387fff80b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c387fff80c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c387fff80d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 =>0x0c387fff80e0: 00 00 00 00 00 00 00 00 00 07[fa]fa fa fa fa fa
   0x0c387fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c387fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c387fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c387fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c387fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 Shadow byte legend (one shadow byte represents 8 application bytes):
   Addressable:           00
   Partially addressable: 01 02 03 04 05 06 07 
   Heap left redzone:       fa
   Freed heap region:       fd
   Stack left redzone:      f1
   Stack mid redzone:       f2
   Stack right redzone:     f3
   Stack after return:      f5
   Stack use after scope:   f8
   Global redzone:          f9
   Global init order:       f6
   Poisoned by user:        f7
   Container overflow:      fc
   Array cookie:            ac
   Intra object redzone:    bb
   ASan internal:           fe
   Left alloca redzone:     ca
   Right alloca redzone:    cb
   Shadow gap:              cc
 ==182439==ABORTING

Platform

DISTRIB_ID=Ubuntu DISTRIB_RELEASE=16.04 DISTRIB_CODENAME=xenial DISTRIB_DESCRIPTION="Ubuntu 16.04.6 LTS"

poc