tiffcrop: FPE in computeOutputPixelOffsets, tiffcrop.c:5802
Summary
There is a FPE in computeOutputPixelOffsets in tools/tiffcrop.c:5802. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. Note that this crash is different from #347 (closed).
Version
LIBTIFF, Version 4.3.0, commit id 5e180045 (Fri Feb 25 10:38:31 2022 +0000)
Steps to reproduce
# CFLAGS="-g -fsanitize=address -fno-omit-frame-pointer" CXXFLAGS="-g -fsanitize=address -fno-omit-frame-pointer" ./configure --prefix=$PWD/build_asan --disable-shared
# make -j; make install; make clean
./build_asan/bin/tiffcrop -H 341 poc /tmp/foo
TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.
TIFFReadDirectory: Warning, Unknown field with tag 32582 (0x7f46) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 8192 (0x2000) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 304 (0x130) encountered.
poc_tiffcrop/00008: Warning, Nonstandard tile length 65290, convert file.
TIFFReadDirectory: Warning, Unknown field with tag 8232 (0x2028) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 9 (0x9) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 1 (0x1) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 59395 (0xe803) encountered.
TIFFFetchNormalTag: Warning, Incorrect count for "NumberOfInks"; tag ignored.
TIFFFetchNormalTag: Warning, Sanity check on size of "Tag 32582" value failed; tag ignored.
TIFFFetchNormalTag: Warning, IO error during reading of "Tag 8192"; tag ignored.
TIFFReadDirectory: Warning, Invalid data type for tag StripOffsets.
TIFFFetchNormalTag: Warning, Incorrect count for "Orientation"; tag ignored.
TIFFFetchNormalTag: Warning, IO error during reading of "Tag 304"; tag ignored.
TIFFReadDirectory: Warning, Invalid data type for tag StripByteCounts.
TIFFAdvanceDirectory: Error fetching directory count.
loadImage: Image lacks Photometric interpretation tag.
Fax4Decode: Bad code word at line 0 of tile 0 (x 0).
Fax4Decode: Warning, Premature EOL at line 0 of tile 0 (got 0, expected 127).
ASAN:DEADLYSIGNAL
=================================================================
==390948==ERROR: AddressSanitizer: FPE on unknown address 0x5558d237fc30 (pc 0x5558d237fc30 bp 0x7ffc94abb850 sp 0x7ffc94abb7c0 T0)
#0 0x5558d237fc2f in computeOutputPixelOffsets /root/programs/libtiff/tools/tiffcrop.c:5802
#1 0x5558d236bd30 in main /root/programs/libtiff/tools/tiffcrop.c:2440
#2 0x7f26c9bc0bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
#3 0x5558d2362869 in _start (/root/programs/libtiff/build_asan/bin/tiffcrop+0x28869)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE /root/programs/libtiff/tools/tiffcrop.c:5802 in computeOutputPixelOffsets
==390948==ABORTING
Platform
# uname -a
Linux 4a409ce47130 5.4.0-70-generic #78~18.04.1-Ubuntu SMP Sat Mar 20 14:10:07 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux