Red Hat Bugzilla – Bug 603699
libtiff: TIFFFieldWithTag assertion failure
Last modified: 2015-06-01 08:41:23 EDT
Description of problem:
Yet another "crasher" from Sauli Pahlman reported in Launchpad:
Unknown tag can cause libtiff to abort program execution in tif_dirinfo.c _TIFFFieldWithTag (or _TIFFFieldWithName) due to failed assertion failure. This can be tested with e.g. tiff2rgba on the test image file.
Version-Release number of selected component (if applicable):
This issue does not affect libtiff in RHEL-3/4/5. Even though problematic assert is part of upstream sources of older libtiff versions, it was removed from RHEL packages via libtiff-*-ormandy.patch added in RHSA-2006:0603 (see bug #199111).
Removing assert causes libtiff to try to deref NULL on multiple places.
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release. Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release. This request is not yet committed for
This turns out to be already fixed in my local copy of 3.9.2, as a result of the patch I submitted for our bug #554371 (see http://bugzilla.maptools.org/show_bug.cgi?id=2210). I haven't tested yet to see if it affects 3.8 or before.
There's not assert abort with libtiff-unknown-tags.patch applied.
Making this public, as there is public upstream bug for the issue.
This was assigned the name CVE-2010-2481.
(In reply to comment #8)
> This was assigned the name CVE-2010-2481.
Actually, this should be a crash described as CVE-2010-2631.
Red Hat Enterprise Linux 6.0 is now available and should resolve
the problem described in this bug report. This report is therefore being closed
with a resolution of CURRENTRELEASE. You may reopen this bug report if the
solution does not work for you.