Skip to content
GitLab
Closed
Issue created by p870613@p870613

AddressSanitizer: heap-buffer-overflow /home/lin/libtiff/tools/tiffcrop.c:3433:16 in extractContigSamplesShifted24bits

Summary SUMMARY:AddressSanitizer: heap-buffer-overflow /home/lin/libtiff/tools/tiffcrop.c:3433:16 in extractContigSamplesShifted24bits

Version

➜  tiffcrop_test git:(master) ✗ ./tiffcrop -v
Library Release: LIBTIFF, Version 4.3.0
Copyright (c) 1988-1996 Sam Leffler
Copyright (c) 1991-1996 Silicon Graphics, Inc.
Tiffcrop version: 2.4, last updated: 12-13-2010
Tiffcp code: Copyright (c) 1988-1997 Sam Leffler
           : Copyright (c) 1991-1997 Silicon Graphics, Inc
Tiffcrop additions: Copyright (c) 2007-2010 Richard Nolde

At branch 27f399af (libtiff version)

Steps to reproduce

git clone git@gitlab.com:libtiff/libtiff.git
cd libtiff/
./autogen.sh
./configure CC=gcc CXX=g++ CFLAGS="-g -fsanitize=address" --disable-shared & make
./tools/tiffcrop -i -E r -X 1 -Y 10 -Z 10:10,1:1 -e s -R 90 ./poc ./out2

(How one can reproduce the issue - this is very important)

Platform

➜  libtiff git:(master) ✗ gcc --version
gcc (Ubuntu 7.5.0-3ubuntu1~18.04) 7.5.0
Copyright (C) 2017 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

➜  libtiff git:(master) ✗ uname -r
5.4.0-91-generic
➜  libtiff git:(master) ✗ lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 18.04.5 LTS
Release:	18.04
Codename:	bionic

(Operating system, architecture, compiler details)

  • ASAN
TIFFFetchNormalTag: Warning, IO error during reading of "DocumentName"; tag ignored.
TIFFReadDirectory: Warning, Sum of Photometric type-related color channels and ExtraSamples doesn't match SamplesPerPixel. Defining non-color channels as ExtraSamples..
TIFFAdvanceDirectory: Error fetching directory count.
ZIPDecode: Decoding error at scanline 0, incorrect header check.
extractContigSamplesShifted24bits: Invalid start column value 27 ignored.
extractContigSamplesShifted24bits: Invalid end column value 28 ignored.
extractContigSamplesShifted24bits: Invalid start column value 27 ignored.
extractContigSamplesShifted24bits: Invalid end column value 28 ignored.
extractContigSamplesShifted24bits: Invalid start column value 27 ignored.
extractContigSamplesShifted24bits: Invalid end column value 28 ignored.
=================================================================
==3417897==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6070000000dd at pc 0x0000004efeaf bp 0x7ffe8026de50 sp 0x7ffe8026de48
WRITE of size 1 at 0x6070000000dd thread T0
    #0 0x4efeae in extractContigSamplesShifted24bits /home/lin/libtiff/tools/tiffcrop.c:3433:16
    #1 0x4d0d46 in extractSeparateRegion /home/lin/libtiff/tools/tiffcrop.c:6668:20
    #2 0x4d0d46 in processCropSelections /home/lin/libtiff/tools/tiffcrop.c:7559:11
    #3 0x4d0d46 in main /home/lin/libtiff/tools/tiffcrop.c:2396:13
    #4 0x7fda2669d0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #5 0x41c53d in _start (/home/lin/libtiff/tools/tiffcrop_test/out/master/queue_info/crashes/tiffcrop+0x41c53d)

0x6070000000dd is located 0 bytes to the right of 77-byte region [0x607000000090,0x6070000000dd)
allocated by thread T0 here:
    #0 0x494c7d in malloc (/home/lin/libtiff/tools/tiffcrop_test/out/master/queue_info/crashes/tiffcrop+0x494c7d)
    #1 0x58fc14 in _TIFFmalloc /home/lin/libtiff/libtiff/tif_unix.c:314:10
    #2 0x7fda2669d0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/lin/libtiff/tools/tiffcrop.c:3433:16 in extractContigSamplesShifted24bits
Shadow bytes around the buggy address:
  0x0c0e7fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c0e7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c0e7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c0e7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c0e7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fa fa
=>0x0c0e7fff8010: fa fa 00 00 00 00 00 00 00 00 00[05]fa fa fa fa
  0x0c0e7fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0e7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0e7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0e7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0e7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3417897==ABORTING

poc:poc.zip

Thanks !!

Edited by p870613