Re: CVE-2017-7592: libtiff: left shift

[Simon McVittie <smcv () debian org>]

On Mon, 10 Apr 2017 at 07:03:25 +0000, Agostino Sarubbo wrote:
> Since there is no cast, *(pp+1) is treated as int, so
> UndefinedBehaviorSanitizer says:
> runtime error: left shift of 134 by 24 places cannot be represented in type
> 'int'

This is a bug, but how is it a security vulnerability? Can an attacker
exploit it for DoS or code execution or something with a malformed TIFF
image?

    S