Summary There is a FPE in computeOutputPixelOffsets in tools/tiffcrop.c:5802. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. **Note that this crash is different from https://gitlab.com/libtiff/libtiff/-/issues/347.** Version LIBTIFF, Version 4.3.0, commit id 5e18004500cda10d9074bdb6166b054e95b659ed (Fri Feb 25 10:38:31 2022 +0000) Steps to reproduce ``` # CFLAGS="-g -fsanitize=address -fno-omit-frame-pointer" CXXFLAGS="-g -fsanitize=address -fno-omit-frame-pointer" ./configure --prefix=$PWD/build_asan --disable-shared # make -j; make install; make clean ./build_asan/bin/tiffcrop -H 341 poc /tmp/foo TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order. TIFFReadDirectory: Warning, Unknown field with tag 32582 (0x7f46) encountered. TIFFReadDirectory: Warning, Unknown field with tag 8192 (0x2000) encountered. TIFFReadDirectory: Warning, Unknown field with tag 304 (0x130) encountered. poc_tiffcrop/00008: Warning, Nonstandard tile length 65290, convert file. TIFFReadDirectory: Warning, Unknown field with tag 8232 (0x2028) encountered. TIFFReadDirectory: Warning, Unknown field with tag 9 (0x9) encountered. TIFFReadDirectory: Warning, Unknown field with tag 1 (0x1) encountered. TIFFReadDirectory: Warning, Unknown field with tag 59395 (0xe803) encountered. TIFFFetchNormalTag: Warning, Incorrect count for "NumberOfInks"; tag ignored. TIFFFetchNormalTag: Warning, Sanity check on size of "Tag 32582" value failed; tag ignored. TIFFFetchNormalTag: Warning, IO error during reading of "Tag 8192"; tag ignored. TIFFReadDirectory: Warning, Invalid data type for tag StripOffsets. TIFFFetchNormalTag: Warning, Incorrect count for "Orientation"; tag ignored. TIFFFetchNormalTag: Warning, IO error during reading of "Tag 304"; tag ignored. TIFFReadDirectory: Warning, Invalid data type for tag StripByteCounts. TIFFAdvanceDirectory: Error fetching directory count. loadImage: Image lacks Photometric interpretation tag. Fax4Decode: Bad code word at line 0 of tile 0 (x 0). Fax4Decode: Warning, Premature EOL at line 0 of tile 0 (got 0, expected 127). ASAN:DEADLYSIGNAL ================================================================= ==390948==ERROR: AddressSanitizer: FPE on unknown address 0x5558d237fc30 (pc 0x5558d237fc30 bp 0x7ffc94abb850 sp 0x7ffc94abb7c0 T0) #0 0x5558d237fc2f in computeOutputPixelOffsets /root/programs/libtiff/tools/tiffcrop.c:5802 #1 0x5558d236bd30 in main /root/programs/libtiff/tools/tiffcrop.c:2440 #2 0x7f26c9bc0bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6) #3 0x5558d2362869 in _start (/root/programs/libtiff/build_asan/bin/tiffcrop+0x28869) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: FPE /root/programs/libtiff/tools/tiffcrop.c:5802 in computeOutputPixelOffsets ==390948==ABORTING ``` Platform ``` # uname -a Linux 4a409ce47130 5.4.0-70-generic #78~18.04.1-Ubuntu SMP Sat Mar 20 14:10:07 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux ``` [poc](/uploads/d118ece58f17f5208c366d867f6fb79f/poc)