oss-sec mailing list archives
CVE-2016-5322:libtiff 4.0.6 extractContigSamplesBytes: out-of-bounds read
From: 张开翔 <zhangkaixiang () 360 cn>
Date: Wed, 15 Jun 2016 02:36:19 +0000
Details ======= Product: libtiff Affected Versions: <= 4.0.6 Vulnerability Type: illegel read Vendor URL: http://www.remotesensing.org/libtiff/ Credit: Kaixiang Zhang of the Cloud Security Team, Qihoo 360 CVE ID: CVE-2016-5322 Tested system version: fedora23 32bit fedora23 64bit CentOS Linux release 7.1.1503 64bit Introduction ======= It was always corrupted when I use tiffcrop command followed by a crafted TIFF image .The vulnerbility exists in extractContigSamplesBytes() without checking the buffer length when reading, Attackers could exploit this issue to cause denial-of-service. Here is the stack info: gdb –args ./tiffcrop extractContigSamplesBytes.tif tmpout.tif --- --- Program received signal SIGSEGV, Segmentation fault. extractContigSamplesBytes (in=0x6647b0 "@z\335\367\377\177", out=out@entry=0x66d9a0 "@z\335\367\377\177", cols=cols@entry=32, sample=sample@entry=0, spp=spp@entry=16385, bps=bps@entry=256, count=count@entry=1, start=1, start@entry=0, end=end@entry=32) at tiffcrop.c:2705 2705 *dst++ = *src++; (gdb) bt #0 extractContigSamplesBytes (in=0x6647b0 "@z\335\367\377\177", out=out@entry=0x66d9a0 "@z\335\367\377\177", cols=cols@entry=32, sample=sample@entry=0, spp=spp@entry=16385, bps=bps@entry=256, count=count@entry=1, start=1, start@entry=0, end=end@entry=32) at tiffcrop.c:2705 #1 0x00000000004379a7 in extractContigSamplesToBuffer (dump=<optimized out>, bps=256, spp=16385, sample=0, cols=<optimized out>, rows=<optimized out>, in=0x6647b0 "@z\335\367\377\177", out=0x66d9a0 "@z\335\367\377\177") at tiffcrop.c:3493 #2 writeBufferToSeparateStrips (out=out@entry=0x662570, buf=buf@entry=0x6647b0 "@z\335\367\377\177", length=length@entry=32, width=width@entry=32, spp=spp@entry=16385, dump=dump@entry=0x7fffffffc260) at tiffcrop.c:1165 #3 0x000000000043e729 in writeCroppedImage (in=in@entry=0x662010, out=0x662570, image=image@entry=0x7fffffff7950, dump=dump@entry=0x7fffffffc260, width=32, length=32, crop_buff=crop_buff@entry=0x6647b0 "@z\335\367\377\177", pagenum=pagenum@entry=0, total_pages=total_pages@entry=1) at tiffcrop.c:7866 #4 0x0000000000408acb in main (argc=<optimized out>, argv=<optimized out>) at tiffcrop.c:2326 (gdb) p src $4 = (uint8 *) 0x6e47d0 <Address 0x6e47d0 out of bounds>
Current thread:
- CVE-2016-5322:libtiff 4.0.6 extractContigSamplesBytes: out-of-bounds read 张开翔 (Jun 14)