Heap buffer overflow in extractContigSamples32bits, tiffcrop.c
Summary
There is a heap buffer overflow in tiffcrop, extractContigSamples32bits. tiffcrop.c, which could lead to denial of service. This may relate to a incomplete fix of issue #271 (closed).
Version
LIBTIFF, Version 4.4.0, commit 4c3ddd99
Steps to reproduce
Compile with flag
-O0 -g -fsanitize=address
Run
./tiffcrop -i poc /dev/null
Here is the trace reported by ASAN:
==3737423==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60d0000000c8 at pc 0x00000053345f bp 0x7ffcd3e96970 sp 0x7ffcd3e96968
READ of size 1 at 0x60d0000000c8 thread T0
#0 0x53345e in extractContigSamples32bits /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c
#1 0x53063d in extractContigSamplesToBuffer /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c:3716:19
#2 0x53063d in writeBufferToSeparateStrips /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c:1228:11
#3 0x52050b in writeCroppedImage /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c:8209:11
#4 0x5070c6 in main /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c:2442:15
#5 0x7fefb08db082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
#6 0x41d5ad in _start (/benchmark/libtiff/build-a/tools/tiffcrop+0x41d5ad)
0x60d0000000c8 is located 0 bytes to the right of 136-byte region [0x60d000000040,0x60d0000000c8)
allocated by thread T0 here:
#0 0x4c26cf in malloc /dependence/llvm11/llvm-11.0.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
#1 0x5278fd in limitMalloc /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c:634:10
#2 0x5278fd in rotateImage /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c:8628:34
SUMMARY: AddressSanitizer: heap-buffer-overflow /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c in extractContigSamples32bits
Shadow bytes around the buggy address:
0x0c1a7fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c1a7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c1a7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c1a7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c1a7fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
=>0x0c1a7fff8010: 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa
0x0c1a7fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==3737423==ABORTING
Platform
DISTRIB_ID=Ubuntu DISTRIB_RELEASE=20.04 DISTRIB_CODENAME=focal DISTRIB_DESCRIPTION="Ubuntu 20.04.5 LTS"