Skip to content

tiffcrop : heap-buffer-overflow in TIFFWriteDirectoryTagColormap() at /libtiff/tif_dirwrite.c:2054 (SIGSEGV)

Summary

An SIGSEGV caused when using tiffcrop.

AddressSanitizer reports it as heap-buffer-overflow.

Version

$ ./tools/tiffcrop -v
Library Release: LIBTIFF, Version 4.5.0
Copyright (c) 1988-1996 Sam Leffler
Copyright (c) 1991-1996 Silicon Graphics, Inc.
Tiffcp code: Copyright (c) 1988-1997 Sam Leffler
           : Copyright (c) 1991-1997 Silicon Graphics, Inc
Tiffcrop additions: Copyright (c) 2007-2010 Richard Nolde

$ git log --oneline -1
9bd48f0d (HEAD -> master, origin/master, origin/HEAD) Merge branch 'mymaster1' into 'master'

Steps to reproduce

make

git clone https://gitlab.com/libtiff/libtiff.git
cd libtiff
./autogen.sh
./configure
make

run

$ ./tiffnorm/libtiff/tools/tiffcrop -c jpeg -X 8 ./pocmin /dev/null
TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.
TIFFReadDirectory: Warning, Unknown field with tag 12336 (0x3030) encountered.
TIFFFetchNormalTag: Defined set_field_type of custom tag 12336 (Tag 12336) is TIFF_SETGET_UNDEFINED and thus tag is not read from file.
TIFFReadDirectory: Warning, TIFF directory is missing required "StripByteCounts" field, calculating from imagelength.
TIFFAdvanceDirectory: Error fetching directory count.
loadImage: Image lacks Photometric interpretation tag.
writeCroppedImage: JPEG compression requires 8 or 12 bits per sample.
writeRegions: Unable to write new image.
TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.
TIFFReadDirectory: Warning, Unknown field with tag 12336 (0x3030) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 304 (0x130) encountered.
TIFFFetchNormalTag: Defined set_field_type of custom tag 12336 (Tag 12336) is TIFF_SETGET_UNDEFINED and thus tag is not read from file.
TIFFFetchNormalTag: Defined set_field_type of custom tag 304 (Tag 304) is TIFF_SETGET_UNDEFINED and thus tag is not read from file.
TIFFReadDirectory: Warning, TIFF directory is missing required "StripByteCounts" field, calculating from imagelength.
loadImage: Image lacks Photometric interpretation tag.
JPEGSetupEncode: BitsPerSample 304 not allowed for JPEG.
/dev/null: Error, can't write strip 0.
: Unable to write contiguous strip data for page 1.
TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.
TIFFReadDirectory: Warning, Unknown field with tag 12336 (0x3030) encountered.
TIFFFetchNormalTag: Defined set_field_type of custom tag 12336 (Tag 12336) is TIFF_SETGET_UNDEFINED and thus tag is not read from file.
TIFFReadDirectory: Warning, TIFF directory is missing required "StripByteCounts" field, calculating from imagelength.
loadImage: Image lacks Photometric interpretation tag.
writeCroppedImage: JPEG compression requires 8 or 12 bits per sample.
writeRegions: Unable to write new image.
TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.
TIFFReadDirectory: Warning, Unknown field with tag 12 (0xc) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 3 (0x3) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 12336 (0x3030) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 4 (0x4) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 0 (0x0) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 304 (0x130) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 868 (0x364) encountered.
TIFFFetchNormalTag: Defined set_field_type of custom tag 12 (Tag 12) is TIFF_SETGET_UNDEFINED and thus tag is not read from file.
TIFFFetchNormalTag: Warning, IO error during reading of "Tag 3"; tag ignored.
TIFFFetchNormalTag: Defined set_field_type of custom tag 12336 (Tag 12336) is TIFF_SETGET_UNDEFINED and thus tag is not read from file.
TIFFFetchNormalTag: Warning, IO error during reading of "Tag 4"; tag ignored.
TIFFFetchNormalTag: Defined set_field_type of custom tag 0 (Tag 0) is TIFF_SETGET_UNDEFINED and thus tag is not read from file.
TIFFFetchNormalTag: Defined set_field_type of custom tag 304 (Tag 304) is TIFF_SETGET_UNDEFINED and thus tag is not read from file.
TIFFFetchNormalTag: Defined set_field_type of custom tag 868 (Tag 868) is TIFF_SETGET_UNDEFINED and thus tag is not read from file.
TIFFReadDirectory: Warning, TIFF directory is missing required "StripByteCounts" field, calculating from imagelength.
loadImage: Image lacks Photometric interpretation tag.
JPEGSetupEncode: BitsPerSample 304 not allowed for JPEG.
/dev/null: Error, can't write strip 0.
: Unable to write contiguous strip data for page 3.
fish: Job 1, './tiffnorm/libtiff/tools/tiffcr…' terminated by signal SIGSEGV (Address boundary error)

Platform

$ uname -a
Linux fuzzer-System-Product-Name 5.15.0-69-generic #76~20.04.1-Ubuntu SMP Mon Mar 20 15:54:19 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

$ gcc --version
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0
Copyright (C) 2019 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

ASAN report

$ ./libtiff/tools/tiffcrop -c jpeg -X 8 ./pocmin /dev/null
TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.
TIFFReadDirectory: Warning, Unknown field with tag 12336 (0x3030) encountered.
TIFFFetchNormalTag: Defined set_field_type of custom tag 12336 (Tag 12336) is TIFF_SETGET_UNDEFINED and thus tag is not read from file.
TIFFReadDirectory: Warning, TIFF directory is missing required "StripByteCounts" field, calculating from imagelength.
TIFFAdvanceDirectory: Error fetching directory count.
loadImage: Image lacks Photometric interpretation tag.
writeCroppedImage: JPEG compression requires 8 or 12 bits per sample.
writeRegions: Unable to write new image.
TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.
TIFFReadDirectory: Warning, Unknown field with tag 12336 (0x3030) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 304 (0x130) encountered.
TIFFFetchNormalTag: Defined set_field_type of custom tag 12336 (Tag 12336) is TIFF_SETGET_UNDEFINED and thus tag is not read from file.
TIFFFetchNormalTag: Defined set_field_type of custom tag 304 (Tag 304) is TIFF_SETGET_UNDEFINED and thus tag is not read from file.
TIFFReadDirectory: Warning, TIFF directory is missing required "StripByteCounts" field, calculating from imagelength.
loadImage: Image lacks Photometric interpretation tag.
JPEGSetupEncode: BitsPerSample 304 not allowed for JPEG.
/dev/null: Error, can't write strip 0.
: Unable to write contiguous strip data for page 1.
TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.
TIFFReadDirectory: Warning, Unknown field with tag 12336 (0x3030) encountered.
TIFFFetchNormalTag: Defined set_field_type of custom tag 12336 (Tag 12336) is TIFF_SETGET_UNDEFINED and thus tag is not read from file.
TIFFReadDirectory: Warning, TIFF directory is missing required "StripByteCounts" field, calculating from imagelength.
loadImage: Image lacks Photometric interpretation tag.
writeCroppedImage: JPEG compression requires 8 or 12 bits per sample.
writeRegions: Unable to write new image.
TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.
TIFFReadDirectory: Warning, Unknown field with tag 12 (0xc) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 3 (0x3) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 12336 (0x3030) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 4 (0x4) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 0 (0x0) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 304 (0x130) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 868 (0x364) encountered.
TIFFFetchNormalTag: Defined set_field_type of custom tag 12 (Tag 12) is TIFF_SETGET_UNDEFINED and thus tag is not read from file.
TIFFFetchNormalTag: Warning, IO error during reading of "Tag 3"; tag ignored.
TIFFFetchNormalTag: Defined set_field_type of custom tag 12336 (Tag 12336) is TIFF_SETGET_UNDEFINED and thus tag is not read from file.
TIFFFetchNormalTag: Warning, IO error during reading of "Tag 4"; tag ignored.
TIFFFetchNormalTag: Defined set_field_type of custom tag 0 (Tag 0) is TIFF_SETGET_UNDEFINED and thus tag is not read from file.
TIFFFetchNormalTag: Defined set_field_type of custom tag 304 (Tag 304) is TIFF_SETGET_UNDEFINED and thus tag is not read from file.
TIFFFetchNormalTag: Defined set_field_type of custom tag 868 (Tag 868) is TIFF_SETGET_UNDEFINED and thus tag is not read from file.
TIFFReadDirectory: Warning, TIFF directory is missing required "StripByteCounts" field, calculating from imagelength.
loadImage: Image lacks Photometric interpretation tag.
JPEGSetupEncode: BitsPerSample 304 not allowed for JPEG.
/dev/null: Error, can't write strip 0.
: Unable to write contiguous strip data for page 3.
=================================================================
==582885==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000420 at pc 0x7f40d4fc8490 bp 0x7ffd17f9f7e0 sp 0x7ffd17f9ef88
READ of size 131072 at 0x602000000420 thread T0
    #0 0x7f40d4fc848f in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:790
    #1 0x556ad8cfd097 in _TIFFmemcpy /home/fuzzer/paper_eval/report/libtiff/libtiff/tif_unix.c:345
    #2 0x556ad8cdac87 in TIFFWriteDirectoryTagColormap /home/fuzzer/paper_eval/report/libtiff/libtiff/tif_dirwrite.c:2054
    #3 0x556ad8cd45cc in TIFFWriteDirectorySec /home/fuzzer/paper_eval/report/libtiff/libtiff/tif_dirwrite.c:742
    #4 0x556ad8cd1580 in TIFFWriteDirectory /home/fuzzer/paper_eval/report/libtiff/libtiff/tif_dirwrite.c:237
    #5 0x556ad8c818fb in writeCroppedImage /home/fuzzer/paper_eval/report/libtiff/tools/tiffcrop.c:9216
    #6 0x556ad8c7ba50 in writeSelections /home/fuzzer/paper_eval/report/libtiff/tools/tiffcrop.c:7999
    #7 0x556ad8c608e0 in main /home/fuzzer/paper_eval/report/libtiff/tools/tiffcrop.c:2825
    #8 0x7f40d4b33082 in __libc_start_main ../csu/libc-start.c:308
    #9 0x556ad8c5717d in _start (/home/fuzzer/paper_eval/report/libtiff/tools/tiffcrop+0x2a17d)

0x602000000420 is located 0 bytes to the right of 16-byte region [0x602000000410,0x602000000420)
allocated by thread T0 here:
    #0 0x7f40d503a808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
    #1 0x556ad8cfcfb1 in _TIFFmalloc /home/fuzzer/paper_eval/report/libtiff/libtiff/tif_unix.c:326
    #2 0x556ad8ce6d23 in _TIFFmallocExt /home/fuzzer/paper_eval/report/libtiff/libtiff/tif_open.c:129
    #3 0x556ad8c8aa34 in setByteArray /home/fuzzer/paper_eval/report/libtiff/libtiff/tif_dir.c:55
    #4 0x556ad8c8abc7 in _TIFFsetShortArrayExt /home/fuzzer/paper_eval/report/libtiff/libtiff/tif_dir.c:81
    #5 0x556ad8c8efab in _TIFFVSetField /home/fuzzer/paper_eval/report/libtiff/libtiff/tif_dir.c:443
    #6 0x556ad8d2a9ec in JPEGVSetField /home/fuzzer/paper_eval/report/libtiff/libtiff/tif_jpeg.c:2619
    #7 0x556ad8c964d6 in TIFFVSetField /home/fuzzer/paper_eval/report/libtiff/libtiff/tif_dir.c:1208
    #8 0x556ad8c95ebd in TIFFSetField /home/fuzzer/paper_eval/report/libtiff/libtiff/tif_dir.c:1152
    #9 0x556ad8c5aa4b in cpTag /home/fuzzer/paper_eval/report/libtiff/tools/tiffcrop.c:1736
    #10 0x556ad8c80f90 in writeCroppedImage /home/fuzzer/paper_eval/report/libtiff/tools/tiffcrop.c:9081
    #11 0x556ad8c7ba50 in writeSelections /home/fuzzer/paper_eval/report/libtiff/tools/tiffcrop.c:7999
    #12 0x556ad8c608e0 in main /home/fuzzer/paper_eval/report/libtiff/tools/tiffcrop.c:2825
    #13 0x7f40d4b33082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:790 in __interceptor_memcpy
Shadow bytes around the buggy address:
  0x0c047fff8030: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8040: fa fa 00 00 fa fa 00 00 fa fa fd fa fa fa fd fa
  0x0c047fff8050: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8060: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fd
  0x0c047fff8070: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa
=>0x0c047fff8080: fa fa 00 00[fa]fa 00 00 fa fa 00 00 fa fa fd fa
  0x0c047fff8090: fa fa 00 fa fa fa 00 fa fa fa 00 fa fa fa 00 fa
  0x0c047fff80a0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fa fa
  0x0c047fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==582885==ABORTING

poc

pocmin