Bug 552360

Summary: [abrt] crash detected in libtiff-3.9.2-2.fc12
Product: [Fedora] Fedora Reporter: Adam Goode <adam>
Component: libtiffAssignee: Tom Lane <tgl>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 12CC: hhorak, tgl
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard: abrt_hash:eee6b3fad71b8f68534f1b11353ba9850597ad37
Fixed In Version: 3.9.2-3.fc12 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-01-07 00:58:43 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: backtrace
none
Crasher file
none
New version of jpeg-scanline patch with crash fix none

Description Adam Goode 2010-01-04 19:42:27 UTC 
abrt 1.0.0 detected a crash.

How to reproduce
-----
1. tiffinfo on a file that used to work fine in tiff 3.8.2

Comment: Trying to do TIFFReadDirectory on a particular file crashes in libtiff.
Attached file: backtrace
cmdline: tiffinfo /home/agoode/dd/TRESTLE - 20x Images/CASE3.tif
component: libtiff
executable: /usr/bin/tiffinfo
kernel: 2.6.31.9-174.fc12.x86_64
package: libtiff-3.9.2-2.fc12
rating: 4
reason: Process was terminated by signal 11
Comment 1 Adam Goode 2010-01-04 19:42:29 UTC 
Created attachment 381623 [details]
File: backtrace
Comment 2 Adam Goode 2010-01-04 19:43:31 UTC 
Sorry I don't have the TIFF file yet, it is a medical slide. I am working on getting a de-identified image that I can freely distribute.
Comment 3 Adam Goode 2010-01-04 19:50:51 UTC 
This bug goes away if I don't apply libtiff-jpeg-scanline.patch.
Comment 4 Adam Goode 2010-01-04 21:56:10 UTC 
It's calling TIFFFillTile before td->td_stripbytecount is initialized.
Comment 5 Adam Goode 2010-01-05 17:32:13 UTC 
This only happens with multi-file images, on the directories after the first.
Comment 6 Adam Goode 2010-01-05 17:33:00 UTC 
Created attachment 381800 [details]
Crasher file
Comment 7 Adam Goode 2010-01-05 18:12:54 UTC 
It seems that in multi-file TIFF, not all fields are zeroed in the second go. The patch checks for (tif->tif_scanlinesize > 0) which isn't reset yet.
Comment 8 Adam Goode 2010-01-05 18:32:46 UTC 
Created attachment 381808 [details]
New version of jpeg-scanline patch with crash fix
Comment 9 Fedora Update System 2010-01-06 05:11:59 UTC 
libtiff-3.9.2-3.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/libtiff-3.9.2-3.fc12
Comment 10 Fedora Update System 2010-01-07 00:58:37 UTC 
libtiff-3.9.2-3.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.