Bug 603699

Summary:	libtiff: TIFFFieldWithTag assertion failure
Product:	Red Hat Enterprise Linux 6	Reporter:	Tomas Hoger <thoger>
Component:	libtiff	Assignee:	Tom Lane <tgl>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Ondrej Moriš <omoris>
Severity:	medium	Docs Contact:
Priority:	low
Version:	6.0	CC:	azelinka, hhorak, omoris, vdanen
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libtiff-3.9.4-1.el6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:
Clones:	1148869 1148870 (view as bug list)		Environment:
Last Closed:	2010-11-10 21:04:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	611890, 1148869, 1148870

Description Tomas Hoger 2010-06-14 11:49:29 UTC

Description of problem:
Yet another "crasher" from Sauli Pahlman reported in Launchpad:
  https://bugs.launchpad.net/bugs/592637

Unknown tag can cause libtiff to abort program execution in tif_dirinfo.c _TIFFFieldWithTag (or _TIFFFieldWithName) due to failed assertion failure.  This can be tested with e.g. tiff2rgba on the test image file.

Version-Release number of selected component (if applicable):
libtiff-3.9.2-3.el6.i686

Additional info:
This issue does not affect libtiff in RHEL-3/4/5.  Even though problematic assert is part of upstream sources of older libtiff versions, it was removed from RHEL packages via libtiff-*-ormandy.patch added in RHSA-2006:0603 (see bug #199111).

Removing assert causes libtiff to try to deref NULL on multiple places.

Comment 3 RHEL Program Management 2010-06-14 12:03:29 UTC

This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release.  Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release.  This request is not yet committed for
inclusion.

Comment 4 Tom Lane 2010-06-14 15:33:39 UTC

This turns out to be already fixed in my local copy of 3.9.2, as a result of the patch I submitted for our bug #554371 (see http://bugzilla.maptools.org/show_bug.cgi?id=2210).  I haven't tested yet to see if it affects 3.8 or before.

Comment 5 Tomas Hoger 2010-06-15 10:40:01 UTC

There's not assert abort with libtiff-unknown-tags.patch applied.

Comment 6 Tomas Hoger 2010-06-22 07:18:21 UTC

Making this public, as there is public upstream bug for the issue.

Comment 8 Vincent Danen 2010-07-06 14:56:19 UTC

This was assigned the name CVE-2010-2481.

Comment 9 Tomas Hoger 2010-07-06 19:21:01 UTC

(In reply to comment #8)
> This was assigned the name CVE-2010-2481.    

Actually, this should be a crash described as CVE-2010-2631.

Comment 12 releng-rhel@redhat.com 2010-11-10 21:04:40 UTC

Red Hat Enterprise Linux 6.0 is now available and should resolve
the problem described in this bug report. This report is therefore being closed
with a resolution of CURRENTRELEASE. You may reopen this bug report if the
solution does not work for you.