heap-buffer-overflow /home/lin/libtiff/tools/tiffcrop.c:6865:16 in extractImageSection
Summary SUMMARY: heap-buffer-overflow /home/lin/libtiff/tools/tiffcrop.c:6865:16 in extractImageSection
Version
➜ tiffcrop_test git:(master) ✗ ./tiffcrop -v
Library Release: LIBTIFF, Version 4.3.0
Copyright (c) 1988-1996 Sam Leffler
Copyright (c) 1991-1996 Silicon Graphics, Inc.
Tiffcrop version: 2.4, last updated: 12-13-2010
Tiffcp code: Copyright (c) 1988-1997 Sam Leffler
: Copyright (c) 1991-1997 Silicon Graphics, Inc
Tiffcrop additions: Copyright (c) 2007-2010 Richard Nolde
At branch 27f399af (libtiff version)
Steps to reproduce
git clone git@gitlab.com:libtiff/libtiff.git
cd libtiff/
./autogen.sh
./configure CC=gcc CXX=g++ CFLAGS="-g -fsanitize=address" --disable-shared & make
./tools/tiffcrop -i -Z 0:0,1:1 -S 8:4 ./poc ./out2
(How one can reproduce the issue - this is very important)
Platform
➜ libtiff git:(master) ✗ gcc --version
gcc (Ubuntu 7.5.0-3ubuntu1~18.04) 7.5.0
Copyright (C) 2017 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
➜ libtiff git:(master) ✗ uname -r
5.4.0-91-generic
➜ libtiff git:(master) ✗ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 18.04.5 LTS
Release: 18.04
Codename: bionic
(Operating system, architecture, compiler details)
- ASAN
TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.
TIFFReadDirectory: Warning, Unknown field with tag 3 (0x3) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 40056 (0x9c78) encountered.
TIFFFetchNormalTag: Warning, IO error during reading of "Tag 3"; tag ignored.
TIFFFetchNormalTag: Warning, Incorrect count for "FillOrder"; tag ignored.
TIFFReadDirectory: Warning, Ignoring ColorMap since BitsPerSample tag not found.
loadImage: Image lacks Photometric interpretation tag.
Fax3Decode2D: Warning, Premature EOL at line 0 of strip 0 (got 0, expected 43).
Fax3Decode2D: Bad code word at line 1 of strip 0 (x 35).
Fax3Decode2D: Warning, Premature EOL at line 1 of strip 0 (got 35, expected 43).
Fax3Decode2D: Warning, Line length mismatch at line 2 of strip 0 (got 46, expected 43).
Fax3Decode2D: Warning, Premature EOL at line 3 of strip 0 (got 0, expected 43).
computeOutputPixelOffsets: Output margins cannot be specified with rows and columns.
=================================================================
==1791867==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000000243 at pc 0x0000004db954 bp 0x7ffea5580810 sp 0x7ffea5580808
READ of size 1 at 0x611000000243 thread T0
#0 0x4db953 in extractImageSection /home/lin/libtiff/tools/tiffcrop.c:6865:16
#1 0x4db953 in writeImageSections /home/lin/libtiff/tools/tiffcrop.c:7072:9
#2 0x4db953 in main /home/lin/libtiff/tools/tiffcrop.c:2451:6
#3 0x7f5d698bf0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#4 0x41c53d in _start (/home/lin/libtiff/tools/tiffcrop_test/out/master/queue_info/crashes/tiffcrop+0x41c53d)
0x611000000243 is located 0 bytes to the right of 195-byte region [0x611000000180,0x611000000243)
allocated by thread T0 here:
#0 0x494c7d in malloc (/home/lin/libtiff/tools/tiffcrop_test/out/master/queue_info/crashes/tiffcrop+0x494c7d)
#1 0x58fc14 in _TIFFmalloc /home/lin/libtiff/libtiff/tif_unix.c:314:10
#2 0x4ccba8 in main /home/lin/libtiff/tools/tiffcrop.c:2374:11
#3 0x7f5d698bf0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/lin/libtiff/tools/tiffcrop.c:6865:16 in extractImageSection
Shadow bytes around the buggy address:
0x0c227fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c227fff8000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c227fff8010: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c227fff8020: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c227fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c227fff8040: 00 00 00 00 00 00 00 00[03]fa fa fa fa fa fa fa
0x0c227fff8050: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c227fff8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c227fff8070: 00 00 02 fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c227fff8080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c227fff8090: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==1791867==ABORTING
poc:poc.zip
Thanks !!