Bug 1524116 - exiv2 library: assertion aborted in Exiv2::(anonymous namespace)::readHeader (bigtiffimage.cpp)
Summary: exiv2 library: assertion aborted in Exiv2::(anonymous namespace)::readHeader ...
Status: NEW
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: exiv2 (Show other bugs)
(Show other bugs)
Version: 7.5-Alt
Hardware: Unspecified Linux
unspecified
high
Target Milestone: rc
: ---
Assignee: Jan Grulich
QA Contact: Desktop QE
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-12-10 07:35 UTC by Wei You
Modified: 2018-12-02 02:37 UTC (History)
0 users

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
poc to trigger the vulnerability (18 bytes, application/octet-stream)
2017-12-10 07:35 UTC, Wei You
no flags Details

Description Wei You 2017-12-10 07:35:12 UTC
Created attachment 1365485 [details]
poc to trigger the vulnerability

on 0.26 (the latest version):

there is a reachable assertion aborted in Exiv2::(anonymous namespace)::readHeader in bigtiffimage.cpp, which can be triggered by poc_2.tiff in the attachment.

Note that this vulnerability exists in the exiv2 library, any software using
exiv2 will be affected by this vulnerability. Remote attackers can exploit
this vulnerability cause a denial of service via a crafted tiff file.

As a demonstration, please run the following command-line to trigger this
vulnerability:

./bin/exiv2 poc_2.tiff
exiv2: /homes/you58/exiv2/master/src/bigtiffimage.cpp:113: Exiv2::(anonymous namespace)::Header Exiv2::(anonymous namespace)::readHeader(Exiv2::BasicIo &): Assertion `size == 8' failed.
Aborted (core dumped)


Note You need to log in before you can comment on or make changes to this bug.