Skip to content

fix(tiff): hardening: prevent OOB read, overflow protection #5336

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lgritz wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(tiff): hardening: prevent OOB read, overflow protection #5336

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/fuzz/populate_corpora.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,6 +144,7 @@ def _find_images_root() -> Path:
("../oiio-images/targa", ["tga", "TGA"]),
],
"tiff": [
("testsuite/tiff-misc/src", ["tif", "tiff"]),
("../oiio-images", ["tif", "tiff"]),
("../oiio-images/libtiffpic",["tif", "tiff"]),
("testsuite/tiff-suite/src", ["tif", "tiff"]),
Expand Down
5 changes: 3 additions & 2 deletions src/tiff.imageio/tiffinput.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1962,7 +1962,7 @@ TIFFInput::read_native_scanline_locked(int subimage, int miplevel, int y,
}

// Make sure there's enough scratch space
int nvals = m_spec.width * m_inputchannels;
imagesize_t nvals = imagesize_t(m_spec.width) * m_inputchannels;
if (m_photometric == PHOTOMETRIC_PALETTE && m_bitspersample > 8)
m_scratch.resize(nvals * 2); // special case for 16 bit palette
else
Expand Down Expand Up @@ -2279,6 +2279,7 @@ TIFFInput::read_native_scanlines(int subimage, int miplevel, int ybegin,
read_raw_strips ? "Raw" : "Encoded", y,
err.size() ? err.c_str() : "unknown error");
ok = false;
break; // failed strip read -- bail, don't decompress
}
auto out = this;
auto uncompress_etc = [=, &ok](int /*id*/) {
Expand Down Expand Up @@ -2345,7 +2346,7 @@ TIFFInput::read_native_scanlines(int subimage, int miplevel, int ybegin,

// If we have left over scanlines, read them serially
m_next_scanline = y - m_spec.y;
for (; y < yend; ++y) {
for (; ok && y < yend; ++y) {
if (!read_native_scanline_locked(subimage, miplevel, y, data)) {
ok = false;
break;
Expand Down
3 changes: 3 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff403-b.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,5 +58,8 @@ src/crash-cmyk-1bit.tif : 73 x 43, 3 channel, uint1 tiff
tiff:PhotometricInterpretation: 5
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 28
oiiotool ERROR: read : "src/crash-rawstrip-offset-past-eof.tif": TIFFReadRawStrip failed reading line y=0: Read error at scanline 4294967295; got 0 bytes, expected 28
Full command line was:
> oiiotool --oiioattrib try_all_readers 0 src/crash-rawstrip-offset-past-eof.tif -o out.exr
Comparing "check1.tif" and "ref/check1.tif"
PASS
3 changes: 3 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff403-c.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,5 +58,8 @@ src/crash-cmyk-1bit.tif : 73 x 43, 3 channel, uint1 tiff
tiff:PhotometricInterpretation: 5
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 28
oiiotool ERROR: read : "src/crash-rawstrip-offset-past-eof.tif": TIFFReadRawStrip failed reading line y=0: Read error at scanline 4294967295; got 0 bytes, expected 28
Full command line was:
> oiiotool --oiioattrib try_all_readers 0 src/crash-rawstrip-offset-past-eof.tif -o out.exr
Comparing "check1.tif" and "ref/check1.tif"
PASS
3 changes: 3 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff403.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,5 +58,8 @@ src/crash-cmyk-1bit.tif : 73 x 43, 3 channel, uint1 tiff
tiff:PhotometricInterpretation: 5
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 28
oiiotool ERROR: read : "src/crash-rawstrip-offset-past-eof.tif": TIFFReadRawStrip failed reading line y=0: Read error at scanline 4294967295; got 0 bytes, expected 28
Full command line was:
> oiiotool --oiioattrib try_all_readers 0 src/crash-rawstrip-offset-past-eof.tif -o out.exr
Comparing "check1.tif" and "ref/check1.tif"
PASS
3 changes: 3 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff409.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,5 +58,8 @@ src/crash-cmyk-1bit.tif : 73 x 43, 3 channel, uint1 tiff
tiff:PhotometricInterpretation: 5
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 28
oiiotool ERROR: read : "src/crash-rawstrip-offset-past-eof.tif": TIFFReadRawStrip failed reading line y=0: Read error at scanline 4294967295; got 0 bytes, expected 28
Full command line was:
> oiiotool --oiioattrib try_all_readers 0 src/crash-rawstrip-offset-past-eof.tif -o out.exr
Comparing "check1.tif" and "ref/check1.tif"
PASS
3 changes: 3 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff410.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,5 +58,8 @@ src/crash-cmyk-1bit.tif : 73 x 43, 3 channel, uint1 tiff
tiff:PhotometricInterpretation: 5
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 28
oiiotool ERROR: read : "src/crash-rawstrip-offset-past-eof.tif": TIFFReadRawStrip failed reading line y=0: Read error at scanline 4294967295; got 0 bytes, expected 28
Full command line was:
> oiiotool --oiioattrib try_all_readers 0 src/crash-rawstrip-offset-past-eof.tif -o out.exr
Comparing "check1.tif" and "ref/check1.tif"
PASS
3 changes: 3 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff430.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,5 +73,8 @@ src/crash-cmyk-1bit.tif : 73 x 43, 3 channel, uint1 tiff
tiff:PhotometricInterpretation: 5
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 28
oiiotool ERROR: read : "src/crash-rawstrip-offset-past-eof.tif": TIFFReadRawStrip failed reading line y=0: Read error at scanline 4294967295; got 0 bytes, expected 28
Full command line was:
> oiiotool --oiioattrib try_all_readers 0 src/crash-rawstrip-offset-past-eof.tif -o out.exr
Comparing "check1.tif" and "ref/check1.tif"
PASS
3 changes: 3 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff470-b.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,5 +73,8 @@ src/crash-cmyk-1bit.tif : 73 x 43, 3 channel, uint1 tiff
tiff:PhotometricInterpretation: 5
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 28
oiiotool ERROR: read : "src/crash-rawstrip-offset-past-eof.tif": TIFFReadRawStrip failed reading line y=0: Read error at scanline 4294967295; got 0 bytes, expected 28
Full command line was:
> oiiotool --oiioattrib try_all_readers 0 src/crash-rawstrip-offset-past-eof.tif -o out.exr
Comparing "check1.tif" and "ref/check1.tif"
PASS
3 changes: 3 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff470-c.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,5 +73,8 @@ src/crash-cmyk-1bit.tif : 73 x 43, 3 channel, uint1 tiff
tiff:PhotometricInterpretation: 5
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 28
oiiotool ERROR: read : "src/crash-rawstrip-offset-past-eof.tif": TIFFReadRawStrip failed reading line y=0: Read error at scanline 4294967295; got 0 bytes, expected 28
Full command line was:
> oiiotool --oiioattrib try_all_readers 0 src/crash-rawstrip-offset-past-eof.tif -o out.exr
Comparing "check1.tif" and "ref/check1.tif"
PASS
3 changes: 3 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff470.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,5 +73,8 @@ src/crash-cmyk-1bit.tif : 73 x 43, 3 channel, uint1 tiff
tiff:PhotometricInterpretation: 5
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 28
oiiotool ERROR: read : "src/crash-rawstrip-offset-past-eof.tif": TIFFReadRawStrip failed reading line y=0: Read error at scanline 4294967295; got 0 bytes, expected 28
Full command line was:
> oiiotool --oiioattrib try_all_readers 0 src/crash-rawstrip-offset-past-eof.tif -o out.exr
Comparing "check1.tif" and "ref/check1.tif"
PASS
3 changes: 3 additions & 0 deletions testsuite/tiff-misc/ref/out.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,5 +58,8 @@ src/crash-cmyk-1bit.tif : 73 x 43, 3 channel, uint1 tiff
tiff:PhotometricInterpretation: 5
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 28
oiiotool ERROR: read : "src/crash-rawstrip-offset-past-eof.tif": TIFFReadRawStrip failed reading line y=0: Read error at scanline 4294967295; got 0 bytes, expected 28
Full command line was:
> oiiotool --oiioattrib try_all_readers 0 src/crash-rawstrip-offset-past-eof.tif -o out.exr
Comparing "check1.tif" and "ref/check1.tif"
PASS
5 changes: 5 additions & 0 deletions testsuite/tiff-misc/run.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,4 +40,9 @@
# causing a heap buffer overflow.
command += info_command ("src/crash-cmyk-1bit.tif", safematch=True)

# Regression: a valid DEFLATE TIFF whose StripOffsets[0] points past EOF must
# be rejected cleanly during the pixel read (not read out of bounds). Placed
# last so its output appends at the tail of every libtiff-version ref variant.
command += oiiotool ("--oiioattrib try_all_readers 0 src/crash-rawstrip-offset-past-eof.tif -o out.exr", failureok = True)

outputs = [ "check1.tif", "out.txt" ]
Binary file added testsuite/tiff-misc/src/crash-rawstrip-offset-past-eof.tif
View file
Open in desktop
Binary file not shown.
Loading