Headline
CVE-2023-0804: Merge branch 'tiffcrop_composite_image_assumption_test_fix#496' into 'master' (33aee127) · Commits · libtiff / libtiff · GitLab
LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.
Skip to content
Commit 33aee127 authored Feb 05, 2023 by Even Rouault
Browse files
Merge branch ‘tiffcrop_composite_image_assumption_test_fix#496’ into ‘master’
tiffcrop: added check for assumption on composite images (fixes #496)
Closes #501, #500, #498, #497 et #496
See merge request !466
Pipeline #767946029 passed with stages in 11 minutes and 12 seconds
- Changes 1
- Pipelines 1
…
…
@@ -5935,18 +5935,40 @@ static int computeInputPixelOffsets(struct crop_mask *crop,
crop->regionlist[i].buffsize = buffsize;
crop->bufftotal += buffsize;
/* For composite images with more than one region, the
* combined_length or combined_width always needs to be equal,
* respectively.
* Otherwise, even the first section/region copy
* action might cause buffer overrun. */
if (crop->img_mode == COMPOSITE_IMAGES)
{
switch (crop->edge_ref)
{
case EDGE_LEFT:
case EDGE_RIGHT:
if (i > 0 && zlength != crop->combined_length)
{
TIFFError(
"computeInputPixelOffsets",
"Only equal length regions can be combined for "
"-E left or right");
return (-1);
}
crop->combined_length = zlength;
crop->combined_width += zwidth;
break;
case EDGE_BOTTOM:
case EDGE_TOP: /* width from left, length from top */
default:
if (i > 0 && zwidth != crop->combined_width)
{
TIFFError("computeInputPixelOffsets",
"Only equal width regions can be "
"combined for -E "
“top or bottom”);
return (-1);
}
crop->combined_width = zwidth;
crop->combined_length += zlength;
break;
…
…
@@ -7301,6 +7323,46 @@ static int extractCompositeRegions(struct image_data *image,
crop->combined_width = 0;
crop->combined_length = 0;
/* If there is more than one region, check beforehand whether all the width
* and length values of the regions are the same, respectively. */
switch (crop->edge_ref)
{
default:
case EDGE_TOP:
case EDGE_BOTTOM:
for (i = 1; i < crop->selections; i++)
{
uint32_t crop_width0 =
crop->regionlist[i - 1].x2 - crop->regionlist[i - 1].x1 + 1;
uint32_t crop_width1 =
crop->regionlist[i].x2 - crop->regionlist[i].x1 + 1;
if (crop_width0 != crop_width1)
{
TIFFError("extractCompositeRegions",
"Only equal width regions can be combined for -E "
“top or bottom”);
return (1);
}
}
break;
case EDGE_LEFT:
case EDGE_RIGHT:
for (i = 1; i < crop->selections; i++)
{
uint32_t crop_length0 =
crop->regionlist[i - 1].y2 - crop->regionlist[i - 1].y1 + 1;
uint32_t crop_length1 =
crop->regionlist[i].y2 - crop->regionlist[i].y1 + 1;
if (crop_length0 != crop_length1)
{
TIFFError("extractCompositeRegions",
"Only equal length regions can be combined for "
"-E left or right");
return (1);
}
}
}
for (i = 0; i < crop->selections; i++)
{
/* rows, columns, width, length are expressed in pixels */
…
…
@@ -7325,7 +7387,8 @@ static int extractCompositeRegions(struct image_data *image,
default:
case EDGE_TOP:
case EDGE_BOTTOM:
if ((i > 0) && (crop_width != crop->regionlist[i - 1].width))
if ((crop->selections > i + 1) &&
(crop_width != crop->regionlist[i + 1].width))
{
TIFFError("extractCompositeRegions",
"Only equal width regions can be combined for -E "
…
…
@@ -7418,7 +7481,8 @@ static int extractCompositeRegions(struct image_data *image,
case EDGE_LEFT: /* splice the pieces of each row together, side by
side */
case EDGE_RIGHT:
if ((i > 0) && (crop_length != crop->regionlist[i - 1].length))
if ((crop->selections > i + 1) &&
(crop_length != crop->regionlist[i + 1].length))
{
TIFFError("extractCompositeRegions",
"Only equal length regions can be combined for "
…
…
Related news
Red Hat Security Advisory 2023-5447-01 - The Migration Toolkit for Containers enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Issues addressed include a denial of service vulnerability.
The Migration Toolkit for Containers (MTC) 1.8.0 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-26115: A flaw was found in the Node.js word-wrap module, where it is vulnerable to a denial of service caused by a Regular expression denial of service (ReDoS) issue in the result variable. By sending a specially crafted regex input, a remote attacker can cause a denial of service.
Red Hat Security Advisory 2023-5353-01 - The libtiff packages contain a library of functions for manipulating Tagged Image File Format files. Issues addressed include an out of bounds write vulnerability.
Red Hat Security Advisory 2023-3711-01 - The libtiff packages contain a library of functions for manipulating Tagged Image File Format files. Issues addressed include buffer overflow, out of bounds read, out of bounds write, and use-after-free vulnerabilities.
Ubuntu Security Notice 5923-1 - It was discovered that LibTIFF could be made to read out of bounds when processing certain malformed image files with the tiffcrop tool. If a user were tricked into opening a specially crafted image file, an attacker could possibly use this issue to cause tiffcrop to crash, resulting in a denial of service. It was discovered that LibTIFF could be made to write out of bounds when processing certain malformed image files with the tiffcrop tool. If a user were tricked into opening a specially crafted image file, an attacker could possibly use this issue to cause tiffcrop to crash, resulting in a denial of service, or possibly execute arbitrary code.
Debian Linux Security Advisory 5361-1 - Several flaws were found in tiffcrop, a program distributed by tiff, the Tag Image File Format (TIFF) library and tools. A specially crafted tiff file can lead to an out-of-bounds write or read resulting in a denial of service.