{"id":1068,"date":"2017-01-01T17:35:41","date_gmt":"2017-01-01T15:35:41","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=1068"},"modified":"2017-01-01T17:35:41","modified_gmt":"2017-01-01T15:35:41","slug":"libtiff-invalid-memory-read-in-t2p_writeproc-tiff2pdf-c","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/01\/01\/libtiff-invalid-memory-read-in-t2p_writeproc-tiff2pdf-c\/","title":{"rendered":"libtiff: invalid memory READ in t2p_writeproc (tiff2pdf.c)"},"content":{"rendered":"

Description<\/strong>:
\nLibtiff<\/a> is a software that provides support for the Tag Image File Format (TIFF), a widely used format for storing image data.<\/p>\n

A crafted tiff file revealed an invalid memory read.<\/p>\n

The complete ASan output:<\/p>\n

# tiff2pdf $FILE -o foo\r\nTIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.\r\n111.crashes: Warning, Nonstandard tile length 3, convert file.\r\nTIFFFetchNormalTag: Warning, Incorrect count for \"XResolution\"; tag ignored.\r\nTIFFFetchNormalTag: Warning, ASCII value for tag \"Software\" contains null byte in value; value incorrectly truncated during reading due to implementation limitations.\r\nTIFFAdvanceDirectory: Error fetching directory count.\r\nTIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.\r\n111.crashes: Warning, Nonstandard tile length 3, convert file.\r\nTIFFFetchNormalTag: Warning, Incorrect count for \"XResolution\"; tag ignored.\r\nTIFFFetchNormalTag: Warning, ASCII value for tag \"Software\" contains null byte in value; value incorrectly truncated during reading due to implementation limitations.\r\nTIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.\r\n111.crashes: Warning, Nonstandard tile length 3, convert file.\r\nTIFFFetchNormalTag: Warning, Incorrect count for \"XResolution\"; tag ignored.\r\nTIFFFetchNormalTag: Warning, ASCII value for tag \"Software\" contains null byte in value; value incorrectly truncated during reading due to implementation limitations.\r\nTIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.\r\n111.crashes: Warning, Nonstandard tile length 3, convert file.\r\nTIFFFetchNormalTag: Warning, Incorrect count for \"XResolution\"; tag ignored.\r\nTIFFFetchNormalTag: Warning, ASCII value for tag \"Software\" contains null byte in value; value incorrectly truncated during reading due to implementation limitations.\r\ntiff2pdf: Warning, RGB image 111.crashes has 4 samples per pixel, assuming RGBA.\r\nTIFFReadRawTile: Read error at row 4294967295, col 4294967295, tile 0; got 0 bytes, expected 23297.\r\nTIFFReadRawTile: Read error at row 4294967295, col 4294967295, tile 1; got 0 bytes, expected 513.\r\nTIFFReadRawTile: Read error at row 4294967295, col 4294967295, tile 2; got 512 bytes, expected 65285.\r\nTIFFReadRawTile: Read error at row 4294967295, col 4294967295, tile 3; got 512 bytes, expected 1535.\r\nASAN:DEADLYSIGNAL\r\n=================================================================\r\n==19864==ERROR: AddressSanitizer: SEGV on unknown address 0x61b000020000 (pc 0x7fc86d4a320b bp 0x000000000efc sp 0x7fff06650bf8 T0)\r\n==19864==The signal is caused by a READ memory access.\r\n    #0 0x7fc86d4a320a  \/var\/tmp\/portage\/sys-libs\/glibc-2.22-r4\/work\/glibc-2.22\/string\/..\/sysdeps\/x86_64\/memcpy.S:270\r\n    #1 0x7fc86d491f79 in _IO_file_xsputn \/var\/tmp\/portage\/sys-libs\/glibc-2.22-r4\/work\/glibc-2.22\/libio\/fileops.c:1319\r\n    #2 0x7fc86d487828 in fwrite \/var\/tmp\/portage\/sys-libs\/glibc-2.22-r4\/work\/glibc-2.22\/libio\/iofwrite.c:43\r\n    #3 0x50cdff in t2p_writeproc \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/tools\/tiff2pdf.c:405:21\r\n    #4 0x52baea in t2pWriteFile \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/tools\/tiff2pdf.c:379:10\r\n    #5 0x52baea in t2p_readwrite_pdf_image_tile \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/tools\/tiff2pdf.c:2924\r\n    #6 0x50f1dc in t2p_write_pdf \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/tools\/tiff2pdf.c:5526:16\r\n    #7 0x50bfee in main \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/tools\/tiff2pdf.c:808:2\r\n    #8 0x7fc86d43e61f in __libc_start_main \/var\/tmp\/portage\/sys-libs\/glibc-2.22-r4\/work\/glibc-2.22\/csu\/libc-start.c:289\r\n    #9 0x41a298 in _init (\/usr\/bin\/tiff2pdf+0x41a298)\r\n\r\nAddressSanitizer can not provide additional info.\r\nSUMMARY: AddressSanitizer: SEGV \/var\/tmp\/portage\/sys-libs\/glibc-2.22-r4\/work\/glibc-2.22\/string\/..\/sysdeps\/x86_64\/memcpy.S:270 \r\n==19864==ABORTING\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n4.0.7<\/p>\n
Fixed version:<\/strong>
\nN\/A<\/p>\n
Commit fix:<\/strong>
\nhttps:\/\/github.com\/vadz\/libtiff\/commit\/891b1b908eb92a0e91e9012a8d32ade7088b5a3f<\/a><\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
CVE:<\/strong>
\nN\/A<\/p>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00111-libtiff-invalidread-t2p_writeproc<\/a><\/p>\n
Timeline:<\/strong>
\n2016-12-20: bug discovered and reported to upstream
\n2016-12-20: upstream released a patch
\n2017-01-01: blog post about the issue<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
libtiff: invalid memory READ in t2p_writeproc (tiff2pdf.c)<\/a><\/p><\/blockquote>\n