Bug 871700 (CVE-2012-4564)
| Summary: | CVE-2012-4564 libtiff: Missing return value check in ppm2tiff leading to heap-buffer overflow when reading a tiff file | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Huzaifa S. Sidhpurwala <huzaifas> | ||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||
| Status: | CLOSED ERRATA | QA Contact: | |||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | unspecified | CC: | jlieskov, security-response-team, tgl | ||||
| Target Milestone: | --- | Keywords: | Security | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2012-12-21 08:47:09 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 880907, 885308, 885309, 885310, 885311 | ||||||
| Bug Blocks: | 837581 | ||||||
| Attachments: |
|
||||||
|
Description
Huzaifa S. Sidhpurwala
2012-10-31 06:04:34 UTC
Analysis (I am using libtiff-4.0.3 as the base for the line numbers):
====================================================================
In ppm2tiff.c:241 the following code is used:
buf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
However TIFFScanlineSize() detects an integer overflow using the following code segment:
if ((uint64)n!=m)
{
TIFFErrorExt(tif->tif_clientdata,module,"Integer arithmetic overflow");
n=0;
}
return(n);
}
Due to overflow the return value from TIFFScanlineSize is zero. However ppm2tiff.c does not check this return value and uses zero to malloc memory via _TIFFmalloc.
_TIFFmalloc is just a wrapper around glibc malloc. As per glibc:
Even a request for zero bytes (i.e., malloc(0)) returns a
pointer to something of the minimum allocatable size.
So this causes some memory to be allocated to buf. Later data is written into buf via:
if (TIFFWriteScanline(out, buf, row, 0) < 0)
This causes a heap-based buffer overflow.
Created attachment 635949 [details]
proposed patch
Public via the following Changelog committed upstream:
2012-11-01 Frank Warmerdam <warmerdam>
* tools/ppm2tiff.c: avoid zero size buffer vulnerability.
CVE-2012-4564 - Thanks to Huzaifa Sidhpurwala of the
Red Hat Security Response team for the fix.
This issue affects the version of libtiff as shipped with Red Hat Enterprise Linux 5 and 6. This issue affects the version of libtiff as shipped with Fedora 16 and Fedora 17. Acknowledgements: This issue was discovered by Huzaifa S. Sidhpurwala of Red Hat Security Response Team. Created libtiff tracking bugs for this issue Affects: fedora-all [bug 880907] This issue has been addressed in following products: Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 Via RHSA-2012:1590 https://rhn.redhat.com/errata/RHSA-2012-1590.html libtiff-3.9.7-1.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report. libtiff-3.9.7-1.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report. libtiff-4.0.3-2.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report. |