libtiff: memory allocation failure in _TIFFCheckRealloc (tif_aux.c)

Description:
libtiff is a software that provides support for the Tag Image File Format (TIFF).

During the fuzz of imagemagick, I noticed a memory allocation failure in libtiff. The issue was first reported to the imagemagick’s developers which confirmed that the issue resides in libtiff instead of imagemagick.

The complete ASan output:

# identify $FILE
==26726==ERROR: AddressSanitizer failed to allocate 0x4195c4000 (17605345280) bytes of LargeMmapAllocator (error code: 12)
==26726==Process memory map follows:
        0x000000400000-0x000000520000   /usr/bin/magick
        0x000000720000-0x000000721000   /usr/bin/magick
        0x000000721000-0x000000724000   /usr/bin/magick
        0x000000724000-0x000001397000
        0x00007fff7000-0x00008fff7000
        0x00008fff7000-0x02008fff7000
        0x02008fff7000-0x10007fff8000
        0x600000000000-0x602000000000                                                                                                                                                                                                                                          
        0x602000000000-0x602000010000                                                                                                                                                                                                                                          
        0x602000010000-0x603000000000                                                                                                                                                                                                                                          
        0x603000000000-0x603000010000                                                                                                                                                                                                                                          
        0x603000010000-0x604000000000                                                                                                                                                                                                                                          
        0x604000000000-0x604000020000                                                                                                                                                                                                                                          
        0x604000020000-0x606000000000                                                                                                                                                                                                                                          
        0x606000000000-0x606000020000                                                                                                                                                                                                                                          
        0x606000020000-0x607000000000                                                                                                                                                                                                                                          
        0x607000000000-0x607000010000                                                                                                                                                                                                                                          
        0x607000010000-0x608000000000                                                                                                                                                                                                                                          
        0x608000000000-0x608000010000                                                                                                                                                                                                                                          
        0x608000010000-0x60a000000000                                                                                                                                                                                                                                          
        0x60a000000000-0x60a000020000                                                                                                                                                                                                                                          
        0x60a000020000-0x60b000000000                                                                                                                                                                                                                                          
        0x60b000000000-0x60b000010000                                                                                                                                                                                                                                          
        0x60b000010000-0x60c000000000                                                                                                                                                                                                                                          
        0x60c000000000-0x60c000010000                                                                                                                                                                                                                                          
        0x60c000010000-0x60d000000000                                                                                                                                                                                                                                          
        0x60d000000000-0x60d000010000                                                                                                                                                                                                                                          
        0x60d000010000-0x60e000000000                                                                                                                                                                                                                                          
        0x60e000000000-0x60e000010000                                                                                                                                                                                                                                          
        0x60e000010000-0x60f000000000                                                                                                                                                                                                                                          
        0x60f000000000-0x60f000010000                                                                                                                                                                                                                                          
        0x60f000010000-0x610000000000                                                                                                                                                                                                                                          
        0x610000000000-0x610000010000                                                                                                                                                                                                                                          
        0x610000010000-0x611000000000                                                                                                                                                                                                                                          
        0x611000000000-0x611000010000                                                                                                                                                                                                                                          
        0x611000010000-0x612000000000                                                                                                                                                                                                                                          
        0x612000000000-0x612000010000                                                                                                                                                                                                                                          
        0x612000010000-0x613000000000                                                                                                                                                                                                                                          
        0x613000000000-0x613000010000                                                                                                                                                                                                                                          
        0x613000010000-0x614000000000                                                                                                                                                                                                                                          
        0x614000000000-0x614000020000                                                                                                                                                                                                                                          
        0x614000020000-0x615000000000                                                                                                                                                                                                                                          
        0x615000000000-0x615000020000                                                                                                                                                                                                                                          
        0x615000020000-0x616000000000                                                                                                                                                                                                                                          
        0x616000000000-0x616000020000                                                                                                                                                                                                                                          
        0x616000020000-0x618000000000                                                                                                                                                                                                                                          
        0x618000000000-0x618000020000                                                                                                                                                                                                                                          
        0x618000020000-0x619000000000                                                                                                                                                                                                                                          
        0x619000000000-0x619000020000                                                                                                                                                                                                                                          
        0x619000020000-0x61a000000000                                                                                                                                                                                                                                          
        0x61a000000000-0x61a000020000                                                                                                                                                                                                                                          
        0x61a000020000-0x61b000000000
        0x61b000000000-0x61b000020000
        0x61b000020000-0x61d000000000
        0x61d000000000-0x61d000020000
        0x61d000020000-0x621000000000
        0x621000000000-0x621000020000
        0x621000020000-0x622000000000
        0x622000000000-0x622000020000
        0x622000020000-0x623000000000
        0x623000000000-0x623000020000
        0x623000020000-0x624000000000
        0x624000000000-0x624000020000
        0x624000020000-0x625000000000
        0x625000000000-0x625000020000
        0x625000020000-0x627000000000
        0x627000000000-0x627000030000
        0x627000030000-0x629000000000
        0x629000000000-0x629000010000
        0x629000010000-0x62f000000000
        0x62f000000000-0x62f000030000
        0x62f000030000-0x640000000000
        0x640000000000-0x640000003000
        0x7fa3c74b3000-0x7fa3c7517000   /usr/lib64/libtiff.so.5.2.4
        0x7fa3c7517000-0x7fa3c7717000   /usr/lib64/libtiff.so.5.2.4
        0x7fa3c7717000-0x7fa3c7718000   /usr/lib64/libtiff.so.5.2.4
        0x7fa3c7718000-0x7fa3c771b000   /usr/lib64/libtiff.so.5.2.4
        0x7fa3c771b000-0x7fa3c771c000
        0x7fa3c771c000-0x7fa3c7786000   /usr/lib64/ImageMagick-7.0.3/modules-Q64HDRI/coders/tiff.so
        0x7fa3c7786000-0x7fa3c7986000   /usr/lib64/ImageMagick-7.0.3/modules-Q64HDRI/coders/tiff.so
        0x7fa3c7986000-0x7fa3c7988000   /usr/lib64/ImageMagick-7.0.3/modules-Q64HDRI/coders/tiff.so
        0x7fa3c7988000-0x7fa3c798e000   /usr/lib64/ImageMagick-7.0.3/modules-Q64HDRI/coders/tiff.so
        0x7fa3c798e000-0x7fa3ce000000   /usr/lib64/locale/locale-archive
        0x7fa3ce000000-0x7fa3ce100000
        0x7fa3ce200000-0x7fa3ce300000
        0x7fa3ce31d000-0x7fa3d066f000
        0x7fa3d066f000-0x7fa3d0696000   /usr/lib64/libexpat.so.1.6.0
        0x7fa3d0696000-0x7fa3d0895000   /usr/lib64/libexpat.so.1.6.0
        0x7fa3d0895000-0x7fa3d0898000   /usr/lib64/libexpat.so.1.6.0
        0x7fa3d0898000-0x7fa3d0899000   /usr/lib64/libexpat.so.1.6.0
        0x7fa3d0899000-0x7fa3d09ce000   /usr/lib64/libglib-2.0.so.0.4600.2
        0x7fa3d09ce000-0x7fa3d0bce000   /usr/lib64/libglib-2.0.so.0.4600.2
        0x7fa3d0bce000-0x7fa3d0bcf000   /usr/lib64/libglib-2.0.so.0.4600.2
        0x7fa3d0bcf000-0x7fa3d0bd0000   /usr/lib64/libglib-2.0.so.0.4600.2
        0x7fa3d0bd0000-0x7fa3d0bd1000
        0x7fa3d0bd1000-0x7fa3d0bda000   /usr/lib64/libltdl.so.7.3.1
        0x7fa3d0bda000-0x7fa3d0dd9000   /usr/lib64/libltdl.so.7.3.1
        0x7fa3d0dd9000-0x7fa3d0dda000   /usr/lib64/libltdl.so.7.3.1
        0x7fa3d0dda000-0x7fa3d0ddb000   /usr/lib64/libltdl.so.7.3.1
        0x7fa3d0ddb000-0x7fa3d0df0000   /lib64/libz.so.1.2.8
        0x7fa3d0df0000-0x7fa3d0fef000   /lib64/libz.so.1.2.8
        0x7fa3d0fef000-0x7fa3d0ff0000   /lib64/libz.so.1.2.8
        0x7fa3d0ff0000-0x7fa3d0ff1000   /lib64/libz.so.1.2.8
        0x7fa3d0ff1000-0x7fa3d1000000   /lib64/libbz2.so.1.0.6
        0x7fa3d1000000-0x7fa3d11ff000   /lib64/libbz2.so.1.0.6
        0x7fa3d11ff000-0x7fa3d1200000   /lib64/libbz2.so.1.0.6
        0x7fa3d1200000-0x7fa3d1201000   /lib64/libbz2.so.1.0.6
        0x7fa3d1201000-0x7fa3d12a8000   /usr/lib64/libfreetype.so.6.12.3
        0x7fa3d12a8000-0x7fa3d14a8000   /usr/lib64/libfreetype.so.6.12.3
        0x7fa3d14a8000-0x7fa3d14ae000   /usr/lib64/libfreetype.so.6.12.3
        0x7fa3d14ae000-0x7fa3d14af000   /usr/lib64/libfreetype.so.6.12.3
        0x7fa3d14af000-0x7fa3d14ea000   /usr/lib64/libfontconfig.so.1.8.0
        0x7fa3d14ea000-0x7fa3d16e9000   /usr/lib64/libfontconfig.so.1.8.0
        0x7fa3d16e9000-0x7fa3d16eb000   /usr/lib64/libfontconfig.so.1.8.0
        0x7fa3d16eb000-0x7fa3d16ec000   /usr/lib64/libfontconfig.so.1.8.0
        0x7fa3d16ec000-0x7fa3d18e1000   /usr/lib64/libfftw3.so.3.4.4
        0x7fa3d18e1000-0x7fa3d1ae0000   /usr/lib64/libfftw3.so.3.4.4
        0x7fa3d1ae0000-0x7fa3d1af4000   /usr/lib64/libfftw3.so.3.4.4
        0x7fa3d1af4000-0x7fa3d1af5000   /usr/lib64/libfftw3.so.3.4.4
        0x7fa3d1af5000-0x7fa3d1b03000   /usr/lib64/liblqr-1.so.0.3.2
        0x7fa3d1b03000-0x7fa3d1d02000   /usr/lib64/liblqr-1.so.0.3.2
        0x7fa3d1d02000-0x7fa3d1d03000   /usr/lib64/liblqr-1.so.0.3.2
        0x7fa3d1d03000-0x7fa3d1d04000   /usr/lib64/liblqr-1.so.0.3.2
        0x7fa3d1d04000-0x7fa3d1d57000   /usr/lib64/liblcms2.so.2.0.6
        0x7fa3d1d57000-0x7fa3d1f57000   /usr/lib64/liblcms2.so.2.0.6
        0x7fa3d1f57000-0x7fa3d1f58000   /usr/lib64/liblcms2.so.2.0.6
        0x7fa3d1f58000-0x7fa3d1f5d000   /usr/lib64/liblcms2.so.2.0.6
        0x7fa3d1f5d000-0x7fa3d20f0000   /lib64/libc-2.22.so
        0x7fa3d20f0000-0x7fa3d22f0000   /lib64/libc-2.22.so
        0x7fa3d22f0000-0x7fa3d22f4000   /lib64/libc-2.22.so
        0x7fa3d22f4000-0x7fa3d22f6000   /lib64/libc-2.22.so
        0x7fa3d22f6000-0x7fa3d22fa000
        0x7fa3d22fa000-0x7fa3d2310000   /usr/lib64/gcc/x86_64-pc-linux-gnu/4.9.3/libgcc_s.so.1
        0x7fa3d2310000-0x7fa3d250f000   /usr/lib64/gcc/x86_64-pc-linux-gnu/4.9.3/libgcc_s.so.1
        0x7fa3d250f000-0x7fa3d2510000   /usr/lib64/gcc/x86_64-pc-linux-gnu/4.9.3/libgcc_s.so.1
        0x7fa3d2510000-0x7fa3d2511000   /usr/lib64/gcc/x86_64-pc-linux-gnu/4.9.3/libgcc_s.so.1
        0x7fa3d2511000-0x7fa3d2517000   /lib64/librt-2.22.so
        0x7fa3d2517000-0x7fa3d2717000   /lib64/librt-2.22.so
        0x7fa3d2717000-0x7fa3d2718000   /lib64/librt-2.22.so
        0x7fa3d2718000-0x7fa3d2719000   /lib64/librt-2.22.so
        0x7fa3d2719000-0x7fa3d2730000   /lib64/libpthread-2.22.so
        0x7fa3d2730000-0x7fa3d292f000   /lib64/libpthread-2.22.so
        0x7fa3d292f000-0x7fa3d2930000   /lib64/libpthread-2.22.so
        0x7fa3d2930000-0x7fa3d2931000   /lib64/libpthread-2.22.so
        0x7fa3d2931000-0x7fa3d2935000
        0x7fa3d2935000-0x7fa3d2a32000   /lib64/libm-2.22.so
        0x7fa3d2a32000-0x7fa3d2c31000   /lib64/libm-2.22.so
        0x7fa3d2c31000-0x7fa3d2c32000   /lib64/libm-2.22.so
        0x7fa3d2c32000-0x7fa3d2c33000   /lib64/libm-2.22.so
        0x7fa3d2c33000-0x7fa3d2c35000   /lib64/libdl-2.22.so
        0x7fa3d2c35000-0x7fa3d2e35000   /lib64/libdl-2.22.so
        0x7fa3d2e35000-0x7fa3d2e36000   /lib64/libdl-2.22.so
        0x7fa3d2e36000-0x7fa3d2e37000   /lib64/libdl-2.22.so
        0x7fa3d2e37000-0x7fa3d32fd000   /usr/lib64/libMagickWand-7.Q64HDRI.so.0.0.0
        0x7fa3d32fd000-0x7fa3d34fc000   /usr/lib64/libMagickWand-7.Q64HDRI.so.0.0.0
        0x7fa3d34fc000-0x7fa3d3511000   /usr/lib64/libMagickWand-7.Q64HDRI.so.0.0.0
        0x7fa3d3511000-0x7fa3d3553000   /usr/lib64/libMagickWand-7.Q64HDRI.so.0.0.0
        0x7fa3d3553000-0x7fa3d40e6000   /usr/lib64/libMagickCore-7.Q64HDRI.so.0.0.0
        0x7fa3d40e6000-0x7fa3d42e5000   /usr/lib64/libMagickCore-7.Q64HDRI.so.0.0.0
        0x7fa3d42e5000-0x7fa3d431e000   /usr/lib64/libMagickCore-7.Q64HDRI.so.0.0.0
        0x7fa3d431e000-0x7fa3d4390000   /usr/lib64/libMagickCore-7.Q64HDRI.so.0.0.0
        0x7fa3d4390000-0x7fa3d4393000
        0x7fa3d4393000-0x7fa3d43b5000   /lib64/ld-2.22.so
        0x7fa3d44ad000-0x7fa3d44cd000
        0x7fa3d44cd000-0x7fa3d44f0000   /usr/share/locale/it/LC_MESSAGES/libc.mo
        0x7fa3d44f0000-0x7fa3d44f1000
        0x7fa3d44f5000-0x7fa3d45a7000
        0x7fa3d45a7000-0x7fa3d45b4000
        0x7fa3d45b4000-0x7fa3d45b5000   /lib64/ld-2.22.so
        0x7fa3d45b5000-0x7fa3d45b6000   /lib64/ld-2.22.so
        0x7fa3d45b6000-0x7fa3d45b7000
        0x7fff923b9000-0x7fff923da000   [stack]
        0x7fff923de000-0x7fff923e0000   [vvar]
        0x7fff923e0000-0x7fff923e2000   [vdso]
        0xffffffffff600000-0xffffffffff601000   [vsyscall]
==26726==End of process memory map.
==26726==AddressSanitizer CHECK failed: /var/tmp/portage/sys-devel/llvm-3.8.1-r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/sanitizer_common/sanitizer_common.cc:183 "((0 && "unable to mmap")) != (0)" (0x0, 0x0)
    #0 0x4c9f9d in AsanCheckFailed /var/tmp/portage/sys-devel/llvm-3.8.1-r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/asan/asan_rtl.cc:67
    #1 0x4d0ad3 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) /var/tmp/portage/sys-devel/llvm-3.8.1-r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/sanitizer_common/sanitizer_common.cc:159
    #2 0x4d0cc1 in __sanitizer::ReportMmapFailureAndDie(unsigned long, char const*, char const*, int, bool) /var/tmp/portage/sys-devel/llvm-3.8.1-r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/sanitizer_common/sanitizer_common.cc:183
    #3 0x4d9cfa in __sanitizer::MmapOrDie(unsigned long, char const*, bool) /var/tmp/portage/sys-devel/llvm-3.8.1-r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/sanitizer_common/sanitizer_posix.cc:122
    #4 0x4244ea in __sanitizer::LargeMmapAllocator::Allocate(__sanitizer::AllocatorStats*, unsigned long, unsigned long) /var/tmp/portage/sys-devel/llvm-3.8.1-r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_allocator.h:1033
    #5 0x4244ea in __sanitizer::CombinedAllocator<__sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap, __asan::AsanMapUnmapCallback>, __sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap, __asan::AsanMapUnmapCallback> >, __sanitizer::LargeMmapAllocator >::Allocate(__sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap, __asan::AsanMapUnmapCallback> >*, unsigned long, unsigned long, bool, bool) /var/tmp/portage/sys-devel/llvm-3.8.1-r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_allocator.h:1302
    #6 0x4244ea in __asan::Allocator::Allocate(unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType, bool) /var/tmp/portage/sys-devel/llvm-3.8.1-r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/asan/asan_allocator.cc:368
    #7 0x4c09e1 in realloc /var/tmp/portage/sys-devel/llvm-3.8.1-r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:79
    #8 0x7fa3c74badcb in _TIFFCheckRealloc /tmp/portage/media-libs/tiff-4.0.6/work/tiff-4.0.6/libtiff/tif_aux.c:73
    #9 0x7fa3c74c8599 in ChopUpSingleUncompressedStrip /tmp/portage/media-libs/tiff-4.0.6/work/tiff-4.0.6/libtiff/tif_dirread.c:5519
    #10 0x7fa3c74c8599 in TIFFReadDirectory /tmp/portage/media-libs/tiff-4.0.6/work/tiff-4.0.6/libtiff/tif_dirread.c:4032
    #11 0x7fa3c74e1d21 in TIFFClientOpen /tmp/portage/media-libs/tiff-4.0.6/work/tiff-4.0.6/libtiff/tif_open.c:466
    #12 0x7fa3c7731955 in ReadTIFFImage /tmp/portage/media-gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/coders/tiff.c:1160:8
    #13 0x7fa3d37beb12 in ReadImage /tmp/portage/media-gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickCore/constitute.c:496:13
    #14 0x7fa3d3f56406 in ReadStream /tmp/portage/media-gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickCore/stream.c:1012:9
    #15 0x7fa3d37bd5ca in PingImage /tmp/portage/media-gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickCore/constitute.c:226:9
    #16 0x7fa3d37bde25 in PingImages /tmp/portage/media-gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickCore/constitute.c:326:10
    #17 0x7fa3d30434c3 in IdentifyImageCommand /tmp/portage/media-gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickWand/identify.c:319:18
    #18 0x7fa3d30d926a in MagickCommandGenesis /tmp/portage/media-gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickWand/mogrify.c:183:14
    #19 0x4f1fb5 in MagickMain /tmp/portage/media-gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/utilities/magick.c:145:10
    #20 0x4f1fb5 in main /tmp/portage/media-gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/utilities/magick.c:176
    #21 0x7fa3d1f7d61f in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289
    #22 0x419138 in _init (/usr/bin/magick+0x419138)

Affected version:
4.0.6

Fixed version:
N/A

Commit fix:
N/A

Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.

CVE:
N/A

Reproducer:
https://github.com/asarubbo/poc/blob/master/00032-libtiff-memalloc-_TIFFCheckRealloc

Timeline:
2016-09-14: bug discovered
2016-11-04: bug reported to upstream
2016-11-09: blog post about the issue

Note:
This bug was found with American Fuzzy Lop.

Permalink:

libtiff: memory allocation failure in _TIFFCheckRealloc (tif_aux.c)

This entry was posted in advisories, security. Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.