[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 7 Apr 2016 10:16:58 +0000
From: 张开翔 <zhangkaixiang@....cn>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CVE-2016-3622 libtiff: Divide By Zero in the tiff2rgba tool
Details
=======
Product: libtiff
Affected Versions: <= 4.0.6
Vulnerability Type: Illegel read
Vendor URL: http://www.libtiff.org/
CVE ID: CVE-2016-3631
Credit: Kaixiang Zhang of the Cloud Security Team, Qihoo 360
Introduction
Illegal read occurs in the cpStrips and cpTiles function in thumbnail.c in thumbnail allows attackers to exploit this issue to cause denial-of-service.
libtiff/tools/thumbnail.c:314.
313 for (s = 0; s < ns; s++) {
314 if (bytecounts[s] > (uint64) bufsize) {
315 buf = (unsigned char *)_TIFFrealloc(buf, (tmsize_t)bytecounts[s]);
316 if (!buf)
317 goto bad;
318 bufsize = (tmsize_t)bytecounts[s];
319 }
320 if (TIFFReadRawStrip(in, s, buf, (tmsize_t)bytecounts[s]) < 0 ||
321 TIFFWriteRawStrip(out, s, buf, (tmsize_t)bytecounts[s]) < 0) {
322 _TIFFfree(buf);
323 return 0;
324 }
325 }
gdb --args thumbnail cpStrips.tif tmpout.tif
……
Program received signal SIGSEGV, Segmentation fault.
0x0804c7bf in cpStrips (out=<optimized out>, in=0x8164530) at thumbnail.c:314
314 if (bytecounts[s] > (uint64) bufsize) {
(gdb) bt
#0 0x0804c7bf in cpStrips (out=<optimized out>, in=0x8164530) at thumbnail.c:314
#1 cpIFD (out=<optimized out>, in=<optimized out>) at thumbnail.c:378
#2 main (argc=3, argv=0xbffff384) at thumbnail.c:124
(gdb) p *bytecounts
Cannot access memory at address 0x42900001
References:
[1] http://www.remotesensing.org/libtiff/
[2] http://bugzilla.maptools.org/buglist.cgi?product=libtiff
Thank you!
Best Regards,
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
