Bug 603703

Summary: libtiff: TIFFReadEncodedStrip crash
Product: Red Hat Enterprise Linux 6 Reporter: Tomas Hoger <thoger>
Component: libtiffAssignee: Tom Lane <tgl>
Status: CLOSED CURRENTRELEASE QA Contact: Martin Cermak <mcermak>
Severity: medium Docs Contact:
Priority: medium    
Version: 6.0CC: azelinka, hhorak, mcermak
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: libtiff-3.9.4-1.el6 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-11-10 21:04:42 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 610776    
Attachments:
Description Flags
patch to use defaults properly none

Description Tomas Hoger 2010-06-14 12:06:46 UTC 
Description of problem:
Another libtiff crasher from Sauli Pahlman:
  https://bugs.launchpad.net/bugs/593067

I've not got to have a closer look at this one yet.  Valgrind reports invalid reads / uses of uninitialized values.  I was able to reproduce on 3.9.2 32bit (using tiff2rgba, but it does not crash an all runs), but not on 64bit.

Version-Release number of selected component (if applicable):
libtiff-3.9.2-3.el6.i686

Additional info:
Starting program: /usr/bin/tiff2rgba lp593067-sample.tif /dev/null
TIFFReadDirectory: Warning, lp593067-sample.tif: unknown field with tag 267 (0x10b) encountered.
TIFFReadDirectory: Warning, lp593067-sample.tif: invalid TIFF directory; tags are not sorted in ascending order.
TIFFReadDirectory: Warning, lp593067-sample.tif: unknown field with tag 347 (0x15b) encountered.
lp593067-sample.tif: Invalid YCbCr subsampling.
lp593067-sample.tif: Invalid YCbCr subsampling.

Program received signal SIGSEGV, Segmentation fault.
0x00697366 in __memcpy_ia32 () from /lib/libc.so.6
(gdb) bt
#0  0x00697366 in __memcpy_ia32 () from /lib/libc.so.6
#1  0xaf424c2a in ?? ()
#2  0x00f2d33c in _TIFFmemcpy (d=<value optimized out>, s=<value optimized out>, c=<value optimized out>)
    at /usr/include/bits/string3.h:52
#3  0x00f07fc6 in DumpModeDecode (tif=<value optimized out>, buf=<value optimized out>, cc=<value optimized out>, 
    s=<value optimized out>) at tif_dumpmode.c:87
#4  0x00f2bc63 in TIFFReadEncodedStrip (tif=<value optimized out>, strip=<value optimized out>, 
    buf=<value optimized out>, size=-1354609622) at tif_read.c:163
#5  0x00f132b5 in gtStripContig (img=<value optimized out>, raster=<value optimized out>, w=<value optimized out>, 
    h=<value optimized out>) at tif_getimage.c:833
#6  0x00f10103 in TIFFRGBAImageGet (img=<value optimized out>, raster=<value optimized out>, w=<value optimized out>, 
    h=<value optimized out>) at tif_getimage.c:461
#7  0x00f15750 in TIFFReadRGBAImageOriented (tif=<value optimized out>, rwidth=<value optimized out>, 
    rheight=<value optimized out>, raster=<value optimized out>, orientation=<value optimized out>, 
    stop=<value optimized out>) at tif_getimage.c:480
#8  0x080495c8 in cvt_whole_image (argc=<value optimized out>, argv=<value optimized out>) at tiff2rgba.c:401
#9  tiffcvt (argc=<value optimized out>, argv=<value optimized out>) at tiff2rgba.c:519
#10 main (argc=<value optimized out>, argv=<value optimized out>) at tiff2rgba.c:115

Negative size passed to TIFFReadEncodedStrip seems suspicious.
Comment 3 RHEL Program Management 2010-06-14 12:23:02 UTC 
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release.  Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release.  This request is not yet committed for
inclusion.
Comment 4 RHEL Program Management 2010-06-14 12:42:58 UTC 
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release.  Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release.  This request is not yet committed for
inclusion.
Comment 5 Tom Lane 2010-06-14 16:19:49 UTC 
I think the problem is that some places in tif_strip.c are assuming that YCbCrSubSampling will be provided, which this file doesn't do.  But there is a spec-mandated default, and we should fall back on that.  Does the attached patch fix the symptoms you're seeing?
Comment 6 Tom Lane 2010-06-14 16:20:34 UTC 
Created attachment 423895 [details]
patch to use defaults properly
Comment 7 Tomas Hoger 2010-06-15 08:12:47 UTC 
(In reply to comment #5)
> Does the attached patch fix the symptoms you're seeing?    

Yes.  No crash with the patch applied.
Comment 8 Tom Lane 2010-06-16 18:44:11 UTC 
Filed upstream at http://bugzilla.maptools.org/show_bug.cgi?id=2215
Comment 9 Tomas Hoger 2010-06-22 07:18:12 UTC 
Making this public, as there is public upstream bug for the issue.
Comment 13 Martin Cermak 2010-09-07 08:59:59 UTC 
=> VERIFIED
Comment 14 releng-rhel@redhat.com 2010-11-10 21:04:42 UTC 
Red Hat Enterprise Linux 6.0 is now available and should resolve
the problem described in this bug report. This report is therefore being closed
with a resolution of CURRENTRELEASE. You may reopen this bug report if the
solution does not work for you.