Skip to content
GitLab
Closed
Issue created by p870613@p870613

heap-buffer-overflow /home/lin/libtiff/tools/tiffcrop.c:6865:16 in extractImageSection

Summary SUMMARY: heap-buffer-overflow /home/lin/libtiff/tools/tiffcrop.c:6865:16 in extractImageSection

Version

➜  tiffcrop_test git:(master) ✗ ./tiffcrop -v
Library Release: LIBTIFF, Version 4.3.0
Copyright (c) 1988-1996 Sam Leffler
Copyright (c) 1991-1996 Silicon Graphics, Inc.
Tiffcrop version: 2.4, last updated: 12-13-2010
Tiffcp code: Copyright (c) 1988-1997 Sam Leffler
           : Copyright (c) 1991-1997 Silicon Graphics, Inc
Tiffcrop additions: Copyright (c) 2007-2010 Richard Nolde

At branch 27f399af (libtiff version)

Steps to reproduce

git clone git@gitlab.com:libtiff/libtiff.git
cd libtiff/
./autogen.sh
./configure CC=gcc CXX=g++ CFLAGS="-g -fsanitize=address" --disable-shared & make
./tools/tiffcrop -i -Z 0:0,1:1 -S 8:4 ./poc ./out2

(How one can reproduce the issue - this is very important)

Platform

➜  libtiff git:(master) ✗ gcc --version
gcc (Ubuntu 7.5.0-3ubuntu1~18.04) 7.5.0
Copyright (C) 2017 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

➜  libtiff git:(master) ✗ uname -r
5.4.0-91-generic
➜  libtiff git:(master) ✗ lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 18.04.5 LTS
Release:	18.04
Codename:	bionic

(Operating system, architecture, compiler details)

  • ASAN

TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.
TIFFReadDirectory: Warning, Unknown field with tag 3 (0x3) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 40056 (0x9c78) encountered.
TIFFFetchNormalTag: Warning, IO error during reading of "Tag 3"; tag ignored.
TIFFFetchNormalTag: Warning, Incorrect count for "FillOrder"; tag ignored.
TIFFReadDirectory: Warning, Ignoring ColorMap since BitsPerSample tag not found.
loadImage: Image lacks Photometric interpretation tag.
Fax3Decode2D: Warning, Premature EOL at line 0 of strip 0 (got 0, expected 43).
Fax3Decode2D: Bad code word at line 1 of strip 0 (x 35).
Fax3Decode2D: Warning, Premature EOL at line 1 of strip 0 (got 35, expected 43).
Fax3Decode2D: Warning, Line length mismatch at line 2 of strip 0 (got 46, expected 43).
Fax3Decode2D: Warning, Premature EOL at line 3 of strip 0 (got 0, expected 43).
computeOutputPixelOffsets: Output margins cannot be specified with rows and columns.
=================================================================
==1791867==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000000243 at pc 0x0000004db954 bp 0x7ffea5580810 sp 0x7ffea5580808
READ of size 1 at 0x611000000243 thread T0
    #0 0x4db953 in extractImageSection /home/lin/libtiff/tools/tiffcrop.c:6865:16
    #1 0x4db953 in writeImageSections /home/lin/libtiff/tools/tiffcrop.c:7072:9
    #2 0x4db953 in main /home/lin/libtiff/tools/tiffcrop.c:2451:6
    #3 0x7f5d698bf0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #4 0x41c53d in _start (/home/lin/libtiff/tools/tiffcrop_test/out/master/queue_info/crashes/tiffcrop+0x41c53d)

0x611000000243 is located 0 bytes to the right of 195-byte region [0x611000000180,0x611000000243)
allocated by thread T0 here:
    #0 0x494c7d in malloc (/home/lin/libtiff/tools/tiffcrop_test/out/master/queue_info/crashes/tiffcrop+0x494c7d)
    #1 0x58fc14 in _TIFFmalloc /home/lin/libtiff/libtiff/tif_unix.c:314:10
    #2 0x4ccba8 in main /home/lin/libtiff/tools/tiffcrop.c:2374:11
    #3 0x7f5d698bf0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/lin/libtiff/tools/tiffcrop.c:6865:16 in extractImageSection
Shadow bytes around the buggy address:
  0x0c227fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff8000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c227fff8010: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c227fff8020: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c227fff8040: 00 00 00 00 00 00 00 00[03]fa fa fa fa fa fa fa
  0x0c227fff8050: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c227fff8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff8070: 00 00 02 fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227fff8080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c227fff8090: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1791867==ABORTING

poc:poc.zip

Thanks !!

Edited by p870613