heap-buffer-overflow /home/lin/libtiff/tools/tiffcrop.c:3337:16 in extractContigSamplesShifted16bits

Summary heap-buffer-overflow /home/lin/libtiff/tools/tiffcrop.c:3337:16 in extractContigSamplesShifted16bits

Version

➜  tiffcrop_test git:(master) ✗ ./tiffcrop -v
Library Release: LIBTIFF, Version 4.3.0
Copyright (c) 1988-1996 Sam Leffler
Copyright (c) 1991-1996 Silicon Graphics, Inc.
Tiffcrop version: 2.4, last updated: 12-13-2010
Tiffcp code: Copyright (c) 1988-1997 Sam Leffler
           : Copyright (c) 1991-1997 Silicon Graphics, Inc
Tiffcrop additions: Copyright (c) 2007-2010 Richard Nolde

At branch 27f399af (libtiff version)

Steps to reproduce

git clone git@gitlab.com:libtiff/libtiff.git
cd libtiff/
./autogen.sh
./configure CC=gcc CXX=g++ CFLAGS="-g -fsanitize=address" --disable-shared & make
./tools/tiffcrop -i -E b -Z 0:0,1:1 -e m ./poc ./out2

(How one can reproduce the issue - this is very important)

Platform

➜  libtiff git:(master) ✗ gcc --version
gcc (Ubuntu 7.5.0-3ubuntu1~18.04) 7.5.0
Copyright (C) 2017 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

➜  libtiff git:(master) ✗ uname -r
5.4.0-91-generic
➜  libtiff git:(master) ✗ lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 18.04.5 LTS
Release:	18.04
Codename:	bionic

(Operating system, architecture, compiler details)

  • ASAN
TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.
TIFFFetchNormalTag: Warning, Incorrect count for "PhotometricInterpretation"; tag ignored.
TIFFFetchNormalTag: Warning, IO error during reading of "DocumentName"; tag ignored.
TIFFFetchNormalTag: Warning, Incorrect count for "ResolutionUnit"; tag ignored.
TIFFReadDirectory: Warning, IO error during reading of "ColorMap"; tag ignored.
loadImage: Image lacks Photometric interpretation tag.
LZWDecode: Warning, LZWDecode: Strip 0 not terminated with EOI code.
LZWDecode: Not enough data at scanline 0 (short 512 bytes).
=================================================================
==3542037==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000100 at pc 0x0000004ef4b5 bp 0x7fff39ef2510 sp 0x7fff39ef2508
WRITE of size 1 at 0x604000000100 thread T0
    #0 0x4ef4b4 in extractContigSamplesShifted16bits /home/lin/libtiff/tools/tiffcrop.c:3337:16
    #1 0x4d0e60 in extractSeparateRegion /home/lin/libtiff/tools/tiffcrop.c:6658:21
    #2 0x4d0e60 in processCropSelections /home/lin/libtiff/tools/tiffcrop.c:7559:11
    #3 0x4d0e60 in main /home/lin/libtiff/tools/tiffcrop.c:2396:13
    #4 0x7f0d16b340b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #5 0x41c53d in _start (/home/lin/libtiff/tools/tiffcrop_test/out/master/queue_info/crashes/tiffcrop+0x41c53d)

0x604000000100 is located 0 bytes to the right of 48-byte region [0x6040000000d0,0x604000000100)
allocated by thread T0 here:
    #0 0x494c7d in malloc (/home/lin/libtiff/tools/tiffcrop_test/out/master/queue_info/crashes/tiffcrop+0x494c7d)
    #1 0x58fc14 in _TIFFmalloc /home/lin/libtiff/libtiff/tif_unix.c:314:10
    #2 0x7f0d16b340b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/lin/libtiff/tools/tiffcrop.c:3337:16 in extractContigSamplesShifted16bits
Shadow bytes around the buggy address:
  0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff8000: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 05
  0x0c087fff8010: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
=>0x0c087fff8020:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3542037==ABORTING

poc: poc.zip

Thanks !!

Edited by p870613