|
Message-ID: <1770254.PWeyxy51hj@arcadia> Date: Sun, 01 Jan 2017 16:51:29 +0100 From: Agostino Sarubbo <ago@...too.org> To: oss-security@...ts.openwall.com Subject: libtiff: memcpy-param-overlap in t2p_tile_collapse_left (tiff2pdf.c) Description: Libtiff is a software that provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. A crafted tiff file revealed a memcpy-param-overlap. The complete ASan output: # tiff2pdf $FILE -o foo TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order. TIFFReadDirectory: Warning, Unknown field with tag 2 (0x2) encountered. 1006.crashes: Warning, Nonstandard tile width 769, convert file. TIFFReadDirectory: Warning, Unknown field with tag 7710 (0x1e1e) encountered. TIFFFetchNormalTag: Warning, Incorrect count for "FillOrder"; tag ignored. TIFFFetchNormalTag: Warning, Incorrect count for "XResolution"; tag ignored. TIFFAdvanceDirectory: Error fetching directory count. TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order. TIFFReadDirectory: Warning, Unknown field with tag 2 (0x2) encountered. 1006.crashes: Warning, Nonstandard tile width 769, convert file. TIFFReadDirectory: Warning, Unknown field with tag 7710 (0x1e1e) encountered. TIFFFetchNormalTag: Warning, Incorrect count for "FillOrder"; tag ignored. TIFFFetchNormalTag: Warning, Incorrect count for "XResolution"; tag ignored. TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order. TIFFReadDirectory: Warning, Unknown field with tag 2 (0x2) encountered. 1006.crashes: Warning, Nonstandard tile width 769, convert file. TIFFReadDirectory: Warning, Unknown field with tag 7710 (0x1e1e) encountered. TIFFFetchNormalTag: Warning, Incorrect count for "FillOrder"; tag ignored. TIFFFetchNormalTag: Warning, Incorrect count for "XResolution"; tag ignored. TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order. TIFFReadDirectory: Warning, Unknown field with tag 2 (0x2) encountered. 1006.crashes: Warning, Nonstandard tile width 769, convert file. TIFFReadDirectory: Warning, Unknown field with tag 7710 (0x1e1e) encountered. TIFFFetchNormalTag: Warning, Incorrect count for "FillOrder"; tag ignored. TIFFFetchNormalTag: Warning, Incorrect count for "XResolution"; tag ignored. Fax3Decode2D: Warning, Premature EOL at line 0 of tile 0 (got 768, expected 769). Fax3Decode2D: Warning, Premature EOL at line 1 of tile 0 (got 35, expected 769). Fax3Decode2D: Warning, Premature EOL at line 2 of tile 0 (got 0, expected 769). Fax3Decode2D: Warning, Premature EOL at line 3 of tile 0 (got 0, expected 769). Fax3Decode2D: Uncompressed data (not supported) at line 4 of tile 0 (x 0). Fax3Decode2D: Warning, Premature EOL at line 4 of tile 0 (got 0, expected 769). Fax3Decode2D: Warning, Premature EOL at line 5 of tile 0 (got 0, expected 769). Fax3Decode2D: Warning, Premature EOL at line 7 of tile 0 (got 0, expected 769). Fax3Decode2D: Warning, Premature EOL at line 8 of tile 0 (got 0, expected 769). Fax3Decode2D: Warning, Premature EOL at line 9 of tile 0 (got 0, expected 769). Fax3Decode2D: Warning, Line length mismatch at line 10 of tile 0 (got 1792, expected 769). Fax3Decode2D: Warning, Premature EOL at line 11 of tile 0 (got 0, expected 769). ================================================================= ==29687==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges [0x7f2dcce0b85d,0x7f2dcce0b8ba) and [0x7f2dcce0b861, 0x7f2dcce0b8be) overlap #0 0x4bbee1 in __asan_memcpy /tmp/portage/sys-devel/llvm-3.9.0- r1/work/llvm-3.9.0.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:413 #1 0x7f2dccb87f0d in _TIFFmemcpy /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/libtiff/tif_unix.c:340:2 #2 0x52ac36 in t2p_tile_collapse_left /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:3596:3 #3 0x52ac36 in t2p_readwrite_pdf_image_tile /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:3073 #4 0x50f1dc in t2p_write_pdf /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:5526:16 #5 0x50bfee in main /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:808:2 #6 0x7f2dcbb4361f in __libc_start_main /var/tmp/portage/sys- libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289 #7 0x41a298 in _init (/usr/bin/tiff2pdf+0x41a298) 0x7f2dcce0b85d is located 93 bytes inside of 968448-byte region [0x7f2dcce0b800,0x7f2dccef7f00) allocated by thread T0 here: #0 0x4d3058 in malloc /tmp/portage/sys-devel/llvm-3.9.0- r1/work/llvm-3.9.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64 #1 0x7f2dccb87d7e in _TIFFmalloc /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/libtiff/tif_unix.c:316:10 #2 0x5294e8 in t2p_readwrite_pdf_image_tile /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:2933:29 #3 0x50f1dc in t2p_write_pdf /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:5526:16 #4 0x50bfee in main /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:808:2 #5 0x7f2dcbb4361f in __libc_start_main /var/tmp/portage/sys- libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289 0x7f2dcce0b861 is located 97 bytes inside of 968448-byte region [0x7f2dcce0b800,0x7f2dccef7f00) allocated by thread T0 here: #0 0x4d3058 in malloc /tmp/portage/sys-devel/llvm-3.9.0- r1/work/llvm-3.9.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64 #1 0x7f2dccb87d7e in _TIFFmalloc /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/libtiff/tif_unix.c:316:10 #2 0x5294e8 in t2p_readwrite_pdf_image_tile /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:2933:29 #3 0x50f1dc in t2p_write_pdf /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:5526:16 #4 0x50bfee in main /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:808:2 #5 0x7f2dcbb4361f in __libc_start_main /var/tmp/portage/sys- libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289 SUMMARY: AddressSanitizer: memcpy-param-overlap /tmp/portage/sys- devel/llvm-3.9.0-r1/work/llvm-3.9.0.src/projects/compiler- rt/lib/asan/asan_interceptors.cc:413 in __asan_memcpy ==29687==ABORTING Affected version: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/ad2fccbf5c23da10c5859114a6018a37fdd05095 Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: N/A Reproducer: https://github.com/asarubbo/poc/blob/master/00110-libtiff-memcpy-param-overlap-_TIFFmemcpy Timeline: 2016-12-20: bug discovered and reported to upstream 2016-12-20: upstream released a patch 2017-01-01: blog post about the issue Note: This bug was found with American Fuzzy Lop. Permalink: https://blogs.gentoo.org/ago/2017/01/01/libtiff-memcpy-param-overlap-in-_tiffmemcpy-tif_unix-c -- Agostino Sarubbo Gentoo Linux Developer
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.