## Summary `TIFFReadAndRealloc()` can perform a heap out-of-bounds write when the active TIFF read callback returns a negative `tmsize_t` value during encoded strip loading. The issue is reachable through public libtiff APIs: ``` TIFFClientOpen() / TIFFClientOpenExt() → TIFFReadEncodedStrip() → TIFFFillStrip() → TIFFReadRawStripOrTile2() → TIFFReadAndRealloc() ``` **Root cause** (`libtiff/tif_read.c`, inside `TIFFReadAndRealloc()`): ```c bytes_read = TIFFReadFile(...); already_read += bytes_read; // bytes_read can be (tmsize_t)-1 if (bytes_read != to_read) { memset(tif->tif_rawdata + rawdata_offset + already_read, 0, (size_t)(tif->tif_rawdatasize - rawdata_offset - already_read)); } ``` When `bytes_read == -1`, `already_read` becomes `-1`, and the error path calls: ```c memset(tif_rawdata - 1, 0, tif_rawdatasize + 1) ``` This causes ASAN to report a `heap-buffer-overflow` / out-of-bounds write. This is especially relevant to stream-backed or custom-I/O consumers using `TIFFClientOpen()` / `TIFFClientOpenExt()`, where a network or virtual file read failure can be reported as a negative return value from the read callback. --- ## Version Tested against upstream libtiff master: - **Repository:** https://gitlab.com/libtiff/libtiff.git - **Commit:** `a94d1ded80b9b46327d3982a3c80043b29f23e2e` - **Validation date:** 2026-06-13 - **Local build:** ASAN / UBSAN --- ## Steps To Reproduce The attached file `natural_trigger_local_tcp.c` is a **single self-contained C program**. It requires no external server, no network tooling, and no separate terminal. A background thread acts as a local TCP peer: 1. Sends a valid 200-byte TIFF header (IFD with `StripOffsets = 200`). 2. Waits 300 ms, then closes the socket with `SO_LINGER = 0` → sends TCP RST. The main thread opens the stream via `TIFFClientOpen()` with a read callback that uses the standard `read()` syscall. When TCP RST arrives during strip loading, `read()` returns `-1` (`ECONNRESET`), which propagates directly into `TIFFReadAndRealloc()`. **Build:** ```bash BUILD=<path-to-libtiff-asan-build>/libtiff gcc -g -O0 -fsanitize=address,undefined -pthread \ natural_trigger_local_tcp.c -o natural_trigger_local \ -I/usr/include/x86_64-linux-gnu \ -L$BUILD -ltiff -Wl,-rpath,$BUILD ``` **Run:** ```bash ASAN_OPTIONS=detect_leaks=0 \ LD_LIBRARY_PATH=$BUILD \ ./natural_trigger_local ``` --- ## Observed Result ``` [read] pos=200 req=2 got=-1 (ECONNRESET -> -1 returned to libtiff!) ================================================================= ==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x51900000007f WRITE of size 1025 at 0x51900000007f thread T0 #0 in __asan_memset #1 in TIFFReadAndRealloc libtiff/tif_read.c:133 #2 in TIFFReadRawStripOrTile2 libtiff/tif_read.c:743 #3 in TIFFFillStrip libtiff/tif_read.c:978 #4 in TIFFReadEncodedStrip libtiff/tif_read.c:579 #5 in main natural_trigger_local_tcp.c:234 0x51900000007f is located 1 bytes before 1024-byte region [0x519000000080, 0x519000000480) allocated by thread T0: #0 in realloc #1 in TIFFReadAndRealloc libtiff/tif_read.c:108 ``` --- ## Expected Result `TIFFReadAndRealloc()` should treat a negative read return as an error **before** using the value in pointer or length arithmetic. Expected behavior is a clean read/decode error, for example: ``` TIFFFillStrip: Read error at scanline 0; got 0 bytes, expected 2. ``` — without writing outside the heap allocation. --- ## Impact **Confirmed:** - Heap out-of-bounds write / memory corruption in libtiff encoded strip parsing. - The write occurs **1 byte before** the raw-data allocation and spans the allocated buffer length plus one byte. - The issue is reachable through public libtiff APIs using stream-backed / custom I/O. **Potential security impact:** - **High** for applications that parse attacker-controlled TIFF input with libtiff and custom / stream-backed I/O callbacks. - **Potentially Critical** in automatic server-side thumbnail or decode services where attacker-controlled transport failure can cause the callback to return a negative `tmsize_t` without user interaction. **High-risk deployment scenario:** | Item | Detail | |------|--------| | Primary affected component | `libtiff`, specifically `TIFFReadAndRealloc()` in encoded strip loading | | Confirmed vulnerability | Heap OOB write when a `TIFFClientOpen` / `TIFFClientOpenExt` read callback returns a negative `tmsize_t` | | Attack scenario | Attacker sends partial TIFF stream and resets the connection during strip loading; the service read callback returns `-1`; heap memory in the server process is corrupted | | RCE claim | **Not made** — no instruction pointer control or exploit chain has been demonstrated | --- ## Additional Consumer Reachability Evidence Downstream consumers GDAL and ImageMagick were also tested. **Important distinction:** | Method | GDAL / ImageMagick behaviour | |--------|------------------------------| | Natural syscall-level failure (`EIO` / `ECONNRESET`) | Both convert the failed read into a 0-byte read → clean `TIFFFillStrip` error, **no ASAN OOB write** | | Callback-level injection (`LD_PRELOAD` wrapper forces readproc to return `-1`) | Both reach `TIFFReadAndRealloc()` and reproduce the same ASAN `heap-buffer-overflow` | **Callback-level evidence — GDAL:** ``` [wrap_tiff_cb] TIFFClientOpenExt name=/vsicurl/http://127.0.0.1:9201/temuan2.tif mode=rDOC [wrap_tiff_cb] forcing readproc=-1 ... pos=4096 size=2048 ERROR: AddressSanitizer: heap-buffer-overflow WRITE of size 2049 #1 TIFFReadAndRealloc libtiff/tif_read.c:133 ``` **Callback-level evidence — ImageMagick:** ``` [wrap_tiff_cb] TIFFClientOpen name=/tmp/magick-... mode=rb [wrap_tiff_cb] forcing readproc=-1 ... pos=4096 size=2048 ERROR: AddressSanitizer: heap-buffer-overflow WRITE of size 2049 #1 TIFFReadAndRealloc libtiff/tif_read.c:133 ``` --- ## Suggested Fix Validate `bytes_read` before adding it to `already_read`: ```c bytes_read = TIFFReadFile( tif, tif->tif_rawdata + rawdata_offset + already_read, to_read); +if (bytes_read < 0) + bytes_read = 0; /* treat negative return as zero-byte read */ already_read += bytes_read; ``` Alternatively, return failure immediately on a negative read before any pointer / length arithmetic. **Patched behaviour observed locally:** ``` TIFFFillStrip: Read error at scanline 0; got 0 bytes, expected 2. ``` No ASAN `heap-buffer-overflow` observed after applying the fix. --- ## Platform | Field | Value | |-------|-------| | OS | WSL Linux on Windows | | Architecture | x86_64 | | Compiler | gcc with `-fsanitize=address,undefined` | | libtiff build | ASAN / UBSAN against upstream master commit above | --- ## Attachment `natural_trigger_local_tcp.c` — single self-contained PoC (see above for build/run instructions) [poc_natural_trigger_TIFFReadAndRealloc_OOB.zip](/uploads/984ed48d97c285b5eaab1607b4e976f2/poc_natural_trigger_TIFFReadAndRealloc_OOB.zip)