Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2939714.XjasMqR6Nf@blackgate>
Date: Wed, 09 Nov 2016 15:47:11 +0100
From: Agostino Sarubbo <ago@...too.org>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: libtiff: memory allocation failure in _TIFFCheckRealloc (tif_aux.c)

If it is suitable for a CVE please assign one. Thanks.

Description:
libtiff is a software that provides support for the Tag Image File Format 
(TIFF).

During the fuzz of imagemagick, I noticed a memory allocation failure in 
libtiff. The issue was first reported to the imagemagick’s developers which 
confirmed that the issue resides in libtiff instead of imagemagick.

The complete ASan output:

# identify $FILE
==26726==ERROR: AddressSanitizer failed to allocate 0x4195c4000 (17605345280) 
bytes of LargeMmapAllocator (error code: 12)
==26726==Process memory map follows:
        0x000000400000-0x000000520000   /usr/bin/magick
        0x000000720000-0x000000721000   /usr/bin/magick
        0x000000721000-0x000000724000   /usr/bin/magick
        0x000000724000-0x000001397000
        0x00007fff7000-0x00008fff7000
        0x00008fff7000-0x02008fff7000
        0x02008fff7000-0x10007fff8000
        0x600000000000-0x602000000000                                                                                                                                                                                                                                          
        0x602000000000-0x602000010000                                                                                                                                                                                                                                          
        0x602000010000-0x603000000000                                                                                                                                                                                                                                          
        0x603000000000-0x603000010000                                                                                                                                                                                                                                          
        0x603000010000-0x604000000000                                                                                                                                                                                                                                          
        0x604000000000-0x604000020000                                                                                                                                                                                                                                          
        0x604000020000-0x606000000000                                                                                                                                                                                                                                          
        0x606000000000-0x606000020000                                                                                                                                                                                                                                          
        0x606000020000-0x607000000000                                                                                                                                                                                                                                          
        0x607000000000-0x607000010000                                                                                                                                                                                                                                          
        0x607000010000-0x608000000000                                                                                                                                                                                                                                          
        0x608000000000-0x608000010000                                                                                                                                                                                                                                          
        0x608000010000-0x60a000000000                                                                                                                                                                                                                                          
        0x60a000000000-0x60a000020000                                                                                                                                                                                                                                          
        0x60a000020000-0x60b000000000                                                                                                                                                                                                                                          
        0x60b000000000-0x60b000010000                                                                                                                                                                                                                                          
        0x60b000010000-0x60c000000000                                                                                                                                                                                                                                          
        0x60c000000000-0x60c000010000                                                                                                                                                                                                                                          
        0x60c000010000-0x60d000000000                                                                                                                                                                                                                                          
        0x60d000000000-0x60d000010000                                                                                                                                                                                                                                          
        0x60d000010000-0x60e000000000                                                                                                                                                                                                                                          
        0x60e000000000-0x60e000010000                                                                                                                                                                                                                                          
        0x60e000010000-0x60f000000000                                                                                                                                                                                                                                          
        0x60f000000000-0x60f000010000                                                                                                                                                                                                                                          
        0x60f000010000-0x610000000000                                                                                                                                                                                                                                          
        0x610000000000-0x610000010000                                                                                                                                                                                                                                          
        0x610000010000-0x611000000000                                                                                                                                                                                                                                          
        0x611000000000-0x611000010000                                                                                                                                                                                                                                          
        0x611000010000-0x612000000000                                                                                                                                                                                                                                          
        0x612000000000-0x612000010000                                                                                                                                                                                                                                          
        0x612000010000-0x613000000000                                                                                                                                                                                                                                          
        0x613000000000-0x613000010000                                                                                                                                                                                                                                          
        0x613000010000-0x614000000000                                                                                                                                                                                                                                          
        0x614000000000-0x614000020000                                                                                                                                                                                                                                          
        0x614000020000-0x615000000000                                                                                                                                                                                                                                          
        0x615000000000-0x615000020000                                                                                                                                                                                                                                          
        0x615000020000-0x616000000000                                                                                                                                                                                                                                          
        0x616000000000-0x616000020000                                                                                                                                                                                                                                          
        0x616000020000-0x618000000000                                                                                                                                                                                                                                          
        0x618000000000-0x618000020000                                                                                                                                                                                                                                          
        0x618000020000-0x619000000000                                                                                                                                                                                                                                          
        0x619000000000-0x619000020000                                                                                                                                                                                                                                          
        0x619000020000-0x61a000000000                                                                                                                                                                                                                                          
        0x61a000000000-0x61a000020000                                                                                                                                                                                                                                          
        0x61a000020000-0x61b000000000
        0x61b000000000-0x61b000020000
        0x61b000020000-0x61d000000000
        0x61d000000000-0x61d000020000
        0x61d000020000-0x621000000000
        0x621000000000-0x621000020000
        0x621000020000-0x622000000000
        0x622000000000-0x622000020000
        0x622000020000-0x623000000000
        0x623000000000-0x623000020000
        0x623000020000-0x624000000000
        0x624000000000-0x624000020000
        0x624000020000-0x625000000000
        0x625000000000-0x625000020000
        0x625000020000-0x627000000000
        0x627000000000-0x627000030000
        0x627000030000-0x629000000000
        0x629000000000-0x629000010000
        0x629000010000-0x62f000000000
        0x62f000000000-0x62f000030000
        0x62f000030000-0x640000000000
        0x640000000000-0x640000003000
        0x7fa3c74b3000-0x7fa3c7517000   /usr/lib64/libtiff.so.5.2.4
        0x7fa3c7517000-0x7fa3c7717000   /usr/lib64/libtiff.so.5.2.4
        0x7fa3c7717000-0x7fa3c7718000   /usr/lib64/libtiff.so.5.2.4
        0x7fa3c7718000-0x7fa3c771b000   /usr/lib64/libtiff.so.5.2.4
        0x7fa3c771b000-0x7fa3c771c000
        0x7fa3c771c000-0x7fa3c7786000   /usr/lib64/ImageMagick-7.0.3/modules-
Q64HDRI/coders/tiff.so
        0x7fa3c7786000-0x7fa3c7986000   /usr/lib64/ImageMagick-7.0.3/modules-
Q64HDRI/coders/tiff.so
        0x7fa3c7986000-0x7fa3c7988000   /usr/lib64/ImageMagick-7.0.3/modules-
Q64HDRI/coders/tiff.so
        0x7fa3c7988000-0x7fa3c798e000   /usr/lib64/ImageMagick-7.0.3/modules-
Q64HDRI/coders/tiff.so
        0x7fa3c798e000-0x7fa3ce000000   /usr/lib64/locale/locale-archive
        0x7fa3ce000000-0x7fa3ce100000
        0x7fa3ce200000-0x7fa3ce300000
        0x7fa3ce31d000-0x7fa3d066f000
        0x7fa3d066f000-0x7fa3d0696000   /usr/lib64/libexpat.so.1.6.0
        0x7fa3d0696000-0x7fa3d0895000   /usr/lib64/libexpat.so.1.6.0
        0x7fa3d0895000-0x7fa3d0898000   /usr/lib64/libexpat.so.1.6.0
        0x7fa3d0898000-0x7fa3d0899000   /usr/lib64/libexpat.so.1.6.0
        0x7fa3d0899000-0x7fa3d09ce000   /usr/lib64/libglib-2.0.so.0.4600.2
        0x7fa3d09ce000-0x7fa3d0bce000   /usr/lib64/libglib-2.0.so.0.4600.2
        0x7fa3d0bce000-0x7fa3d0bcf000   /usr/lib64/libglib-2.0.so.0.4600.2
        0x7fa3d0bcf000-0x7fa3d0bd0000   /usr/lib64/libglib-2.0.so.0.4600.2
        0x7fa3d0bd0000-0x7fa3d0bd1000
        0x7fa3d0bd1000-0x7fa3d0bda000   /usr/lib64/libltdl.so.7.3.1
        0x7fa3d0bda000-0x7fa3d0dd9000   /usr/lib64/libltdl.so.7.3.1
        0x7fa3d0dd9000-0x7fa3d0dda000   /usr/lib64/libltdl.so.7.3.1
        0x7fa3d0dda000-0x7fa3d0ddb000   /usr/lib64/libltdl.so.7.3.1
        0x7fa3d0ddb000-0x7fa3d0df0000   /lib64/libz.so.1.2.8
        0x7fa3d0df0000-0x7fa3d0fef000   /lib64/libz.so.1.2.8
        0x7fa3d0fef000-0x7fa3d0ff0000   /lib64/libz.so.1.2.8
        0x7fa3d0ff0000-0x7fa3d0ff1000   /lib64/libz.so.1.2.8
        0x7fa3d0ff1000-0x7fa3d1000000   /lib64/libbz2.so.1.0.6
        0x7fa3d1000000-0x7fa3d11ff000   /lib64/libbz2.so.1.0.6
        0x7fa3d11ff000-0x7fa3d1200000   /lib64/libbz2.so.1.0.6
        0x7fa3d1200000-0x7fa3d1201000   /lib64/libbz2.so.1.0.6
        0x7fa3d1201000-0x7fa3d12a8000   /usr/lib64/libfreetype.so.6.12.3
        0x7fa3d12a8000-0x7fa3d14a8000   /usr/lib64/libfreetype.so.6.12.3
        0x7fa3d14a8000-0x7fa3d14ae000   /usr/lib64/libfreetype.so.6.12.3
        0x7fa3d14ae000-0x7fa3d14af000   /usr/lib64/libfreetype.so.6.12.3
        0x7fa3d14af000-0x7fa3d14ea000   /usr/lib64/libfontconfig.so.1.8.0
        0x7fa3d14ea000-0x7fa3d16e9000   /usr/lib64/libfontconfig.so.1.8.0
        0x7fa3d16e9000-0x7fa3d16eb000   /usr/lib64/libfontconfig.so.1.8.0
        0x7fa3d16eb000-0x7fa3d16ec000   /usr/lib64/libfontconfig.so.1.8.0
        0x7fa3d16ec000-0x7fa3d18e1000   /usr/lib64/libfftw3.so.3.4.4
        0x7fa3d18e1000-0x7fa3d1ae0000   /usr/lib64/libfftw3.so.3.4.4
        0x7fa3d1ae0000-0x7fa3d1af4000   /usr/lib64/libfftw3.so.3.4.4
        0x7fa3d1af4000-0x7fa3d1af5000   /usr/lib64/libfftw3.so.3.4.4
        0x7fa3d1af5000-0x7fa3d1b03000   /usr/lib64/liblqr-1.so.0.3.2
        0x7fa3d1b03000-0x7fa3d1d02000   /usr/lib64/liblqr-1.so.0.3.2
        0x7fa3d1d02000-0x7fa3d1d03000   /usr/lib64/liblqr-1.so.0.3.2
        0x7fa3d1d03000-0x7fa3d1d04000   /usr/lib64/liblqr-1.so.0.3.2
        0x7fa3d1d04000-0x7fa3d1d57000   /usr/lib64/liblcms2.so.2.0.6
        0x7fa3d1d57000-0x7fa3d1f57000   /usr/lib64/liblcms2.so.2.0.6
        0x7fa3d1f57000-0x7fa3d1f58000   /usr/lib64/liblcms2.so.2.0.6
        0x7fa3d1f58000-0x7fa3d1f5d000   /usr/lib64/liblcms2.so.2.0.6
        0x7fa3d1f5d000-0x7fa3d20f0000   /lib64/libc-2.22.so
        0x7fa3d20f0000-0x7fa3d22f0000   /lib64/libc-2.22.so
        0x7fa3d22f0000-0x7fa3d22f4000   /lib64/libc-2.22.so
        0x7fa3d22f4000-0x7fa3d22f6000   /lib64/libc-2.22.so
        0x7fa3d22f6000-0x7fa3d22fa000
        0x7fa3d22fa000-0x7fa3d2310000   /usr/lib64/gcc/x86_64-pc-linux-
gnu/4.9.3/libgcc_s.so.1
        0x7fa3d2310000-0x7fa3d250f000   /usr/lib64/gcc/x86_64-pc-linux-
gnu/4.9.3/libgcc_s.so.1
        0x7fa3d250f000-0x7fa3d2510000   /usr/lib64/gcc/x86_64-pc-linux-
gnu/4.9.3/libgcc_s.so.1
        0x7fa3d2510000-0x7fa3d2511000   /usr/lib64/gcc/x86_64-pc-linux-
gnu/4.9.3/libgcc_s.so.1
        0x7fa3d2511000-0x7fa3d2517000   /lib64/librt-2.22.so
        0x7fa3d2517000-0x7fa3d2717000   /lib64/librt-2.22.so
        0x7fa3d2717000-0x7fa3d2718000   /lib64/librt-2.22.so
        0x7fa3d2718000-0x7fa3d2719000   /lib64/librt-2.22.so
        0x7fa3d2719000-0x7fa3d2730000   /lib64/libpthread-2.22.so
        0x7fa3d2730000-0x7fa3d292f000   /lib64/libpthread-2.22.so
        0x7fa3d292f000-0x7fa3d2930000   /lib64/libpthread-2.22.so
        0x7fa3d2930000-0x7fa3d2931000   /lib64/libpthread-2.22.so
        0x7fa3d2931000-0x7fa3d2935000
        0x7fa3d2935000-0x7fa3d2a32000   /lib64/libm-2.22.so
        0x7fa3d2a32000-0x7fa3d2c31000   /lib64/libm-2.22.so
        0x7fa3d2c31000-0x7fa3d2c32000   /lib64/libm-2.22.so
        0x7fa3d2c32000-0x7fa3d2c33000   /lib64/libm-2.22.so
        0x7fa3d2c33000-0x7fa3d2c35000   /lib64/libdl-2.22.so
        0x7fa3d2c35000-0x7fa3d2e35000   /lib64/libdl-2.22.so
        0x7fa3d2e35000-0x7fa3d2e36000   /lib64/libdl-2.22.so
        0x7fa3d2e36000-0x7fa3d2e37000   /lib64/libdl-2.22.so
        0x7fa3d2e37000-0x7fa3d32fd000   
/usr/lib64/libMagickWand-7.Q64HDRI.so.0.0.0
        0x7fa3d32fd000-0x7fa3d34fc000   
/usr/lib64/libMagickWand-7.Q64HDRI.so.0.0.0
        0x7fa3d34fc000-0x7fa3d3511000   
/usr/lib64/libMagickWand-7.Q64HDRI.so.0.0.0
        0x7fa3d3511000-0x7fa3d3553000   
/usr/lib64/libMagickWand-7.Q64HDRI.so.0.0.0
        0x7fa3d3553000-0x7fa3d40e6000   
/usr/lib64/libMagickCore-7.Q64HDRI.so.0.0.0
        0x7fa3d40e6000-0x7fa3d42e5000   
/usr/lib64/libMagickCore-7.Q64HDRI.so.0.0.0
        0x7fa3d42e5000-0x7fa3d431e000   
/usr/lib64/libMagickCore-7.Q64HDRI.so.0.0.0
        0x7fa3d431e000-0x7fa3d4390000   
/usr/lib64/libMagickCore-7.Q64HDRI.so.0.0.0
        0x7fa3d4390000-0x7fa3d4393000
        0x7fa3d4393000-0x7fa3d43b5000   /lib64/ld-2.22.so
        0x7fa3d44ad000-0x7fa3d44cd000
        0x7fa3d44cd000-0x7fa3d44f0000   
/usr/share/locale/it/LC_MESSAGES/libc.mo
        0x7fa3d44f0000-0x7fa3d44f1000
        0x7fa3d44f5000-0x7fa3d45a7000
        0x7fa3d45a7000-0x7fa3d45b4000
        0x7fa3d45b4000-0x7fa3d45b5000   /lib64/ld-2.22.so
        0x7fa3d45b5000-0x7fa3d45b6000   /lib64/ld-2.22.so
        0x7fa3d45b6000-0x7fa3d45b7000
        0x7fff923b9000-0x7fff923da000   [stack]
        0x7fff923de000-0x7fff923e0000   [vvar]
        0x7fff923e0000-0x7fff923e2000   [vdso]
        0xffffffffff600000-0xffffffffff601000   [vsyscall]
==26726==End of process memory map.
==26726==AddressSanitizer CHECK failed: /var/tmp/portage/sys-devel/llvm-3.8.1-
r2/work/llvm-3.8.1.src/projects/compiler-
rt/lib/sanitizer_common/sanitizer_common.cc:183 "((0 && "unable to mmap")) != 
(0)" (0x0, 0x0)
    #0 0x4c9f9d in AsanCheckFailed /var/tmp/portage/sys-devel/llvm-3.8.1-
r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/asan/asan_rtl.cc:67
    #1 0x4d0ad3 in __sanitizer::CheckFailed(char const*, int, char const*, 
unsigned long long, unsigned long long) /var/tmp/portage/sys-devel/llvm-3.8.1-
r2/work/llvm-3.8.1.src/projects/compiler-
rt/lib/sanitizer_common/sanitizer_common.cc:159
    #2 0x4d0cc1 in __sanitizer::ReportMmapFailureAndDie(unsigned long, char 
const*, char const*, int, bool) /var/tmp/portage/sys-devel/llvm-3.8.1-
r2/work/llvm-3.8.1.src/projects/compiler-
rt/lib/sanitizer_common/sanitizer_common.cc:183
    #3 0x4d9cfa in __sanitizer::MmapOrDie(unsigned long, char const*, bool) 
/var/tmp/portage/sys-devel/llvm-3.8.1-
r2/work/llvm-3.8.1.src/projects/compiler-
rt/lib/sanitizer_common/sanitizer_posix.cc:122
    #4 0x4244ea in 
__sanitizer::LargeMmapAllocator::Allocate(__sanitizer::AllocatorStats*, 
unsigned long, unsigned long) /var/tmp/portage/sys-devel/llvm-3.8.1-
r2/work/llvm-3.8.1.src/projects/compiler-
rt/lib/asan/../sanitizer_common/sanitizer_allocator.h:1033
    #5 0x4244ea in 
__sanitizer::CombinedAllocator<__sanitizer::SizeClassAllocator64<105553116266496ul, 
4398046511104ul, 0ul, __sanitizer::SizeClassMap, 
__asan::AsanMapUnmapCallback>, 
__sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64<105553116266496ul, 
4398046511104ul, 0ul, __sanitizer::SizeClassMap, __asan::AsanMapUnmapCallback> 
>, __sanitizer::LargeMmapAllocator 
>::Allocate(__sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64<105553116266496ul, 
4398046511104ul, 0ul, __sanitizer::SizeClassMap, __asan::AsanMapUnmapCallback> 
>*, unsigned long, unsigned long, bool, bool) /var/tmp/portage/sys-
devel/llvm-3.8.1-r2/work/llvm-3.8.1.src/projects/compiler-
rt/lib/asan/../sanitizer_common/sanitizer_allocator.h:1302
    #6 0x4244ea in __asan::Allocator::Allocate(unsigned long, unsigned long, 
__sanitizer::BufferedStackTrace*, __asan::AllocType, bool) 
/var/tmp/portage/sys-devel/llvm-3.8.1-
r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/asan/asan_allocator.cc:368
    #7 0x4c09e1 in realloc /var/tmp/portage/sys-devel/llvm-3.8.1-
r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:79
    #8 0x7fa3c74badcb in _TIFFCheckRealloc /tmp/portage/media-
libs/tiff-4.0.6/work/tiff-4.0.6/libtiff/tif_aux.c:73
    #9 0x7fa3c74c8599 in ChopUpSingleUncompressedStrip /tmp/portage/media-
libs/tiff-4.0.6/work/tiff-4.0.6/libtiff/tif_dirread.c:5519
    #10 0x7fa3c74c8599 in TIFFReadDirectory /tmp/portage/media-
libs/tiff-4.0.6/work/tiff-4.0.6/libtiff/tif_dirread.c:4032
    #11 0x7fa3c74e1d21 in TIFFClientOpen /tmp/portage/media-
libs/tiff-4.0.6/work/tiff-4.0.6/libtiff/tif_open.c:466
    #12 0x7fa3c7731955 in ReadTIFFImage /tmp/portage/media-
gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/coders/tiff.c:1160:8
    #13 0x7fa3d37beb12 in ReadImage /tmp/portage/media-
gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickCore/constitute.c:496:13
    #14 0x7fa3d3f56406 in ReadStream /tmp/portage/media-
gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickCore/stream.c:1012:9
    #15 0x7fa3d37bd5ca in PingImage /tmp/portage/media-
gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickCore/constitute.c:226:9
    #16 0x7fa3d37bde25 in PingImages /tmp/portage/media-
gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickCore/constitute.c:326:10
    #17 0x7fa3d30434c3 in IdentifyImageCommand /tmp/portage/media-
gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickWand/identify.c:319:18
    #18 0x7fa3d30d926a in MagickCommandGenesis /tmp/portage/media-
gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickWand/mogrify.c:183:14
    #19 0x4f1fb5 in MagickMain /tmp/portage/media-
gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/utilities/magick.c:145:10
    #20 0x4f1fb5 in main /tmp/portage/media-
gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/utilities/magick.c:176
    #21 0x7fa3d1f7d61f in __libc_start_main /var/tmp/portage/sys-
libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289
    #22 0x419138 in _init (/usr/bin/magick+0x419138)

Affected version:
4.0.6

Fixed version:
N/A

Commit fix:
N/A

Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.

CVE:
N/A

Reproducer:
https://github.com/asarubbo/poc/blob/master/00032-libtiff-memalloc-_TIFFCheckRealloc

Timeline:
2016-09-14: bug discovered
2016-11-04: bug reported to upstream
2016-11-09: blog post about the issue

Note:
This bug was found with American Fuzzy Lop.

Permalink:
https://blogs.gentoo.org/ago/2016/11/09/libtiff-memory-allocation-failure-in-_tiffcheckrealloc-tif_aux-c

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.