{"id":1060,"date":"2017-01-01T17:32:30","date_gmt":"2017-01-01T15:32:30","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=1060"},"modified":"2017-05-24T13:58:29","modified_gmt":"2017-05-24T11:58:29","slug":"libtiff-multiple-divide-by-zero","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/01\/01\/libtiff-multiple-divide-by-zero\/","title":{"rendered":"libtiff: multiple divide-by-zero"},"content":{"rendered":"

Description<\/strong>:
\nLibtiff<\/a> is a software that provides support for the Tag Image File Format (TIFF), a widely used format for storing image data.<\/p>\n

Some crafted images, through a fuzzing revealed multiple division by zero. Since the number of the issues, I will post the relevant part of the stacktrace.<\/p>\n

Affected version \/ Tested on:<\/strong>
\n4.0.7
\nFixed version:<\/strong>
\nN\/A
\nCommit fix:<\/strong>
\nhttps:\/\/github.com\/vadz\/libtiff\/commit\/438274f938e046d33cb0e1230b41da32ffe223e1<\/a>
\nReproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00064-libtiff-fpe-TIFFReadEncodedStrip<\/a>
\nRelevant part of the stacktrace:<\/strong><\/p>\n

# tiffcp -i $FILE \/tmp\/foo\r\n==12079==ERROR: AddressSanitizer: FPE on unknown address 0x7fd319436251 (pc 0x7fd319436251 bp 0x7fff851e3d80 sp 0x7fff851e3d30 T0)\r\n    #0 0x7fd319436250 in TIFFReadEncodedStrip \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/libtiff\/tif_read.c:351:22\r\n<\/font><\/pre>\n
CVE:<\/strong>
\nCVE-2016-10266<\/p>\n
###############################################<\/p>\n
Affected version \/ Tested on:<\/strong>
\n4.0.7
\nFixed version:<\/strong>
\nN\/A
\nCommit fix:<\/strong>
\nhttps:\/\/github.com\/vadz\/libtiff\/commit\/43bc256d8ae44b92d2734a3c5bc73957a4d7c1ec<\/a>
\nReproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00083-libtiff-fpe-OJPEGDecodeRaw<\/a>
\nRelevant part of the stacktrace:<\/strong><\/p>\n
# tiffmedian $FILE \/tmp\/foo\r\n==28106==ERROR: AddressSanitizer: FPE on unknown address 0x7faeae7f744e (pc 0x7faeae7f744e bp 0x7ffceab45e40 sp 0x7ffceab45ce0 T0)\r\n    #0 0x7faeae7f744d in OJPEGDecodeRaw \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/libtiff\/tif_ojpeg.c:816:8\r\n<\/font><\/pre>\n
CVE:<\/strong>
\nCVE-2016-10267<\/p>\n
###############################################<\/p>\n
Affected version \/ Tested on:<\/strong>
\n4.0.7
\nFixed version:<\/strong>
\nN\/A
\nCommit fix:<\/strong>
\nhttps:\/\/github.com\/vadz\/libtiff\/commit\/d3c5426395dc53e3345712ac7246c29db9fed8fa<\/a>
\nReproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00099-libtiff-fpe-readSeparateStripsIntoBuffer<\/a>
\nRelevant part of the stacktrace:<\/strong><\/p>\n
# tiffcrop $FILE \/tmp\/foo\r\n==19098==ERROR: AddressSanitizer: FPE on unknown address 0x000000523acf (pc 0x000000523acf bp 0x7ffcb22ada30 sp 0x7ffcb22ad780 T0)\r\n    #0 0x523ace in readSeparateStripsIntoBuffer \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/tools\/tiffcrop.c:4841:36\r\n<\/font><\/pre>\n
###############################################<\/p>\n
Affected version \/ Tested on:<\/strong>
\n4.0.7
\nFixed version:<\/strong>
\nN\/A
\nCommit fix:<\/strong>
\nhttps:\/\/github.com\/vadz\/libtiff\/commit\/a87eb62049f446204ed62c939f965eb76bd98001<\/a>
\nReproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00065-libtiff-fpe-readSeparateTilesIntoBuffer<\/a>
\nRelevant part of the stacktrace:<\/strong><\/p>\n
# tiffcp $FILE \/tmp\/foo\r\n==13262==ERROR: AddressSanitizer: FPE on unknown address 0x00000051c43b (pc 0x00000051c43b bp 0x7ffdc8d81d70 sp 0x7ffdc8d81b20 T0)\r\n    #0 0x51c43a in readSeparateTilesIntoBuffer \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/tools\/tiffcp.c:1434:9\r\n<\/font><\/pre>\n
###############################################<\/p>\n
Affected version \/ Tested on:<\/strong>
\n4.0.7
\nFixed version:<\/strong>
\nN\/A
\nCommit fix:<\/strong>
\nhttps:\/\/github.com\/vadz\/libtiff\/commit\/296803e79542f5523be1009d64574507b9acc239<\/a>
\nReproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00073-libtiff-fpe-writeBufferToSeparateTiles<\/a>
\nRelevant part of the stacktrace:<\/strong><\/p>\n
# tiffcp -i $FILE \/tmp\/foo\r\n==3614==ERROR: AddressSanitizer: FPE on unknown address 0x00000051650a (pc 0x00000051650a bp 0x7fff41587d30 sp 0x7fff41587b00 T0)\r\n    #0 0x516509 in writeBufferToSeparateTiles \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/tools\/tiffcp.c:1591:13\r\n<\/font><\/pre>\n
Credit:<\/strong>
\nThese bugs were discovered by Agostino Sarubbo of Gentoo.<\/p>\n
Timeline:<\/strong>
\n2016-11-20: started to post the issues to upstream
\n2017-01-01: blog post about the issue<\/p>\n
Note:<\/strong>
\nThese bugs were found with American Fuzzy Lop<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
libtiff: multiple divide-by-zero<\/a><\/p><\/blockquote>\n