{"id":1072,"date":"2017-01-01T17:36:07","date_gmt":"2017-01-01T15:36:07","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=1072"},"modified":"2017-01-01T17:37:30","modified_gmt":"2017-01-01T15:37:30","slug":"libtiff-memcpy-param-overlap-in-_tiffmemcpy-tif_unix-c","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/01\/01\/libtiff-memcpy-param-overlap-in-_tiffmemcpy-tif_unix-c\/","title":{"rendered":"libtiff: memcpy-param-overlap in t2p_tile_collapse_left (tiff2pdf.c)"},"content":{"rendered":"<p><strong>Description<\/strong>:<br \/>\n<a href=\"http:\/\/libtiff.maptools.org\">Libtiff<\/a> is a software that provides support for the Tag Image File Format (TIFF), a widely used format for storing image data.<\/p>\n<p>A crafted tiff file revealed a memcpy-param-overlap.<\/p>\n<p>The complete ASan output:<\/p>\n<pre><font size=\"2\"># tiff2pdf $FILE -o foo\r\nTIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.\r\nTIFFReadDirectory: Warning, Unknown field with tag 2 (0x2) encountered.\r\n1006.crashes: Warning, Nonstandard tile width 769, convert file.\r\nTIFFReadDirectory: Warning, Unknown field with tag 7710 (0x1e1e) encountered.\r\nTIFFFetchNormalTag: Warning, Incorrect count for \"FillOrder\"; tag ignored.\r\nTIFFFetchNormalTag: Warning, Incorrect count for \"XResolution\"; tag ignored.\r\nTIFFAdvanceDirectory: Error fetching directory count.\r\nTIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.\r\nTIFFReadDirectory: Warning, Unknown field with tag 2 (0x2) encountered.\r\n1006.crashes: Warning, Nonstandard tile width 769, convert file.\r\nTIFFReadDirectory: Warning, Unknown field with tag 7710 (0x1e1e) encountered.\r\nTIFFFetchNormalTag: Warning, Incorrect count for \"FillOrder\"; tag ignored.\r\nTIFFFetchNormalTag: Warning, Incorrect count for \"XResolution\"; tag ignored.\r\nTIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.\r\nTIFFReadDirectory: Warning, Unknown field with tag 2 (0x2) encountered.\r\n1006.crashes: Warning, Nonstandard tile width 769, convert file.\r\nTIFFReadDirectory: Warning, Unknown field with tag 7710 (0x1e1e) encountered.\r\nTIFFFetchNormalTag: Warning, Incorrect count for \"FillOrder\"; tag ignored.\r\nTIFFFetchNormalTag: Warning, Incorrect count for \"XResolution\"; tag ignored.\r\nTIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.\r\nTIFFReadDirectory: Warning, Unknown field with tag 2 (0x2) encountered.\r\n1006.crashes: Warning, Nonstandard tile width 769, convert file.\r\nTIFFReadDirectory: Warning, Unknown field with tag 7710 (0x1e1e) encountered.\r\nTIFFFetchNormalTag: Warning, Incorrect count for \"FillOrder\"; tag ignored.\r\nTIFFFetchNormalTag: Warning, Incorrect count for \"XResolution\"; tag ignored.\r\nFax3Decode2D: Warning, Premature EOL at line 0 of tile 0 (got 768, expected 769).\r\nFax3Decode2D: Warning, Premature EOL at line 1 of tile 0 (got 35, expected 769).\r\nFax3Decode2D: Warning, Premature EOL at line 2 of tile 0 (got 0, expected 769).\r\nFax3Decode2D: Warning, Premature EOL at line 3 of tile 0 (got 0, expected 769).\r\nFax3Decode2D: Uncompressed data (not supported) at line 4 of tile 0 (x 0).\r\nFax3Decode2D: Warning, Premature EOL at line 4 of tile 0 (got 0, expected 769).\r\nFax3Decode2D: Warning, Premature EOL at line 5 of tile 0 (got 0, expected 769).\r\nFax3Decode2D: Warning, Premature EOL at line 7 of tile 0 (got 0, expected 769).\r\nFax3Decode2D: Warning, Premature EOL at line 8 of tile 0 (got 0, expected 769).\r\nFax3Decode2D: Warning, Premature EOL at line 9 of tile 0 (got 0, expected 769).\r\nFax3Decode2D: Warning, Line length mismatch at line 10 of tile 0 (got 1792, expected 769).\r\nFax3Decode2D: Warning, Premature EOL at line 11 of tile 0 (got 0, expected 769).\r\n=================================================================\r\n==29687==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges [0x7f2dcce0b85d,0x7f2dcce0b8ba) and [0x7f2dcce0b861, 0x7f2dcce0b8be) overlap\r\n    #0 0x4bbee1 in __asan_memcpy \/tmp\/portage\/sys-devel\/llvm-3.9.0-r1\/work\/llvm-3.9.0.src\/projects\/compiler-rt\/lib\/asan\/asan_interceptors.cc:413\r\n    #1 0x7f2dccb87f0d in _TIFFmemcpy \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/libtiff\/tif_unix.c:340:2\r\n    #2 0x52ac36 in t2p_tile_collapse_left \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/tools\/tiff2pdf.c:3596:3\r\n    #3 0x52ac36 in t2p_readwrite_pdf_image_tile \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/tools\/tiff2pdf.c:3073\r\n    #4 0x50f1dc in t2p_write_pdf \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/tools\/tiff2pdf.c:5526:16\r\n    #5 0x50bfee in main \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/tools\/tiff2pdf.c:808:2\r\n    #6 0x7f2dcbb4361f in __libc_start_main \/var\/tmp\/portage\/sys-libs\/glibc-2.22-r4\/work\/glibc-2.22\/csu\/libc-start.c:289\r\n    #7 0x41a298 in _init (\/usr\/bin\/tiff2pdf+0x41a298)\r\n\r\n0x7f2dcce0b85d is located 93 bytes inside of 968448-byte region [0x7f2dcce0b800,0x7f2dccef7f00)\r\nallocated by thread T0 here:\r\n    #0 0x4d3058 in malloc \/tmp\/portage\/sys-devel\/llvm-3.9.0-r1\/work\/llvm-3.9.0.src\/projects\/compiler-rt\/lib\/asan\/asan_malloc_linux.cc:64\r\n    #1 0x7f2dccb87d7e in _TIFFmalloc \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/libtiff\/tif_unix.c:316:10\r\n    #2 0x5294e8 in t2p_readwrite_pdf_image_tile \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/tools\/tiff2pdf.c:2933:29\r\n    #3 0x50f1dc in t2p_write_pdf \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/tools\/tiff2pdf.c:5526:16\r\n    #4 0x50bfee in main \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/tools\/tiff2pdf.c:808:2\r\n    #5 0x7f2dcbb4361f in __libc_start_main \/var\/tmp\/portage\/sys-libs\/glibc-2.22-r4\/work\/glibc-2.22\/csu\/libc-start.c:289\r\n\r\n0x7f2dcce0b861 is located 97 bytes inside of 968448-byte region [0x7f2dcce0b800,0x7f2dccef7f00)\r\nallocated by thread T0 here:\r\n    #0 0x4d3058 in malloc \/tmp\/portage\/sys-devel\/llvm-3.9.0-r1\/work\/llvm-3.9.0.src\/projects\/compiler-rt\/lib\/asan\/asan_malloc_linux.cc:64\r\n    #1 0x7f2dccb87d7e in _TIFFmalloc \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/libtiff\/tif_unix.c:316:10\r\n    #2 0x5294e8 in t2p_readwrite_pdf_image_tile \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/tools\/tiff2pdf.c:2933:29\r\n    #3 0x50f1dc in t2p_write_pdf \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/tools\/tiff2pdf.c:5526:16\r\n    #4 0x50bfee in main \/tmp\/portage\/media-libs\/tiff-4.0.7\/work\/tiff-4.0.7\/tools\/tiff2pdf.c:808:2\r\n    #5 0x7f2dcbb4361f in __libc_start_main \/var\/tmp\/portage\/sys-libs\/glibc-2.22-r4\/work\/glibc-2.22\/csu\/libc-start.c:289\r\n\r\nSUMMARY: AddressSanitizer: memcpy-param-overlap \/tmp\/portage\/sys-devel\/llvm-3.9.0-r1\/work\/llvm-3.9.0.src\/projects\/compiler-rt\/lib\/asan\/asan_interceptors.cc:413 in __asan_memcpy\r\n==29687==ABORTING\r\n<\/font><\/pre>\n<p><strong>Affected version:<\/strong><br \/>\n4.0.7<\/p>\n<p><strong>Fixed version:<\/strong><br \/>\nN\/A<\/p>\n<p><strong>Commit fix:<\/strong><br \/>\n<a href=\"https:\/\/github.com\/vadz\/libtiff\/commit\/ad2fccbf5c23da10c5859114a6018a37fdd05095\">https:\/\/github.com\/vadz\/libtiff\/commit\/ad2fccbf5c23da10c5859114a6018a37fdd05095<\/a><\/p>\n<p><strong>Credit:<\/strong><br \/>\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n<p><strong>CVE:<\/strong><br \/>\nN\/A<\/p>\n<p><strong>Reproducer:<\/strong><br \/>\n<a href=\"https:\/\/github.com\/asarubbo\/poc\/blob\/master\/00110-libtiff-memcpy-param-overlap-_TIFFmemcpy\">https:\/\/github.com\/asarubbo\/poc\/blob\/master\/00110-libtiff-memcpy-param-overlap-_TIFFmemcpy<\/a><\/p>\n<p><strong>Timeline:<\/strong><br \/>\n2016-12-20: bug discovered and reported to upstream<br \/>\n2016-12-20: upstream released a patch<br \/>\n2017-01-01: blog post about the issue<\/p>\n<p><strong>Note:<\/strong><br \/>\nThis bug was found with <a href=\"http:\/\/lcamtuf.coredump.cx\/afl\">American Fuzzy Lop<\/a>.<\/p>\n<p><strong>Permalink:<\/strong><\/p>\n<blockquote data-secret=\"Nu4XVqgwVt\" class=\"wp-embedded-content\"><p><a href=\"http:\/\/blogs.gentoo.org\/ago\/2017\/01\/01\/libtiff-memcpy-param-overlap-in-_tiffmemcpy-tif_unix-c\/\">libtiff: memcpy-param-overlap in t2p_tile_collapse_left (tiff2pdf.c)<\/a><\/p><\/blockquote>\n<p><iframe class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; clip: rect(1px, 1px, 1px, 1px);\" src=\"http:\/\/blogs.gentoo.org\/ago\/2017\/01\/01\/libtiff-memcpy-param-overlap-in-_tiffmemcpy-tif_unix-c\/embed\/#?secret=Nu4XVqgwVt\" data-secret=\"Nu4XVqgwVt\" width=\"600\" height=\"338\" title=\"&#8220;libtiff: memcpy-param-overlap in t2p_tile_collapse_left (tiff2pdf.c)&#8221; &#8212; agostino&#039;s blog\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Description: Libtiff is a software that provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. A crafted tiff file revealed a memcpy-param-overlap. The complete ASan output: # tiff2pdf $FILE -o foo TIFFReadDirectoryCheckOrder: &hellip; <a href=\"https:\/\/blogs.gentoo.org\/ago\/2017\/01\/01\/libtiff-memcpy-param-overlap-in-_tiffmemcpy-tif_unix-c\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":140,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true},"categories":[12,10],"tags":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p2EaBc-hi","_links":{"self":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts\/1072"}],"collection":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/users\/140"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/comments?post=1072"}],"version-history":[{"count":3,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts\/1072\/revisions"}],"predecessor-version":[{"id":1075,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts\/1072\/revisions\/1075"}],"wp:attachment":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/media?parent=1072"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/categories?post=1072"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/tags?post=1072"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}