Return-Path: <tiff-bounces@lists.osgeo.org>
Delivered-To: even.rouault@spatialys.com
Received: from spool.mail.gandi.net (spool5.mail.gandi.net [217.70.178.214])
	by nmboxes134.sd4.0x35.net (Postfix) with ESMTP id A529C60282
	for <even.rouault@spatialys.com>; Mon, 19 Aug 2019 08:28:08 +0000 (UTC)
Received: from lists.osgeo.org (osgeo6.osgeo.osuosl.org [140.211.15.3])
	by spool.mail.gandi.net (Postfix) with ESMTPS id 32E31D80732
	for <even.rouault@spatialys.com>; Mon, 19 Aug 2019 08:28:08 +0000 (UTC)
Received: from osgeo6.osgeo.osuosl.org (localhost [127.0.0.1])
	by lists.osgeo.org (Postfix) with ESMTP id 669606140738;
	Mon, 19 Aug 2019 01:28:04 -0700 (PDT)
Received: from AUS01-ME1-obe.outbound.protection.outlook.com
 (mail-eopbgr1360124.outbound.protection.outlook.com [40.107.136.124])
 by lists.osgeo.org (Postfix) with ESMTPS id 4B1AE6142C68
 for <tiff@lists.osgeo.org>; Mon, 19 Aug 2019 01:28:02 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
 b=iOF5jBPVwTaAPn4uAUorN+gdS6jB1sM3QNNLKpGxlQEkblM2KExXlRdSdMfxeS9f+K7JhJzqDqvIurveO6XwIeWr6tq30SEGBZIKDw1n46Gf+0Pb0NbtXZUJw20O+zndH/7F2IM/LErZYpc9Hz9kYGGa9MYojdTMEf6tw+1R96HC3o/KPmHWgpVNKxcNTjsuIoXXrGl5buCPRZCaashE2Vq7JyA1AntZB3iSdJo5OXNa7NO+8FGKW/FmPNPnpRcKObF7JSsCRe/OftCk1IrqsJ+DAjmhQFTLvUEV2eufueh2iSnNoOKkuom3CfGNrj5a0mwcq0qXMgSirYd4kGfrOA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; 
 s=arcselector9901;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=+XBYC20O9kaDkYNRtHavi2SesUuJotugCPOZV/tIBLk=;
 b=f0orcLhEuT6jK4a13yWKkL4Zffel57GCbu5y+pzprtbgLA4HdMHbvHnJ4VhmTUGI4TbJw1bUeb5FcUPkAjc574aCVZLawrWmKjjagfOQIgsepnJeeFpciRJ1aauqO9p9YK6khV5R5mWO9I2BMdIAYtsAPBY1zoFFr+f45n++Fy9Lk6rIvBwgdI6TRbaOE/s1sFYpo1bwLkDtP//v6avqbFmfQS+wxJ2Z3EVarEKcm+JwN8cJ9FULFtBD6g4edcb94ib/rITSagZCxTMs5z/PCpvg2F4kuki4yyHW1CL3/NRKPdsDuCMymG+2ZvNFZkmZH2TnZsczdV2av3EqyyoGxg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass
 smtp.mailfrom=anu.edu.au; dmarc=pass action=none header.from=anu.edu.au;
 dkim=pass header.d=anu.edu.au; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=ANU365.onmicrosoft.com; s=selector2-ANU365-onmicrosoft-com;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=+XBYC20O9kaDkYNRtHavi2SesUuJotugCPOZV/tIBLk=;
 b=NOXO9sx/ZMKRQ+6OkCo8lJGBx5gQRrJF73BqgF8NeX76AVPk41s16gpvCjA/w02y//UXzAsW7sw3pb74781NEUp+pZfKEy/AuNx1nAIuZ7C05IoJcqZw6E5xBOr3vtTw34sBVnv3ebPSP2NXX0pQ8OP4ft+nycp1b/QcuuASbVI=
Received: from SYCPR01MB4701.ausprd01.prod.outlook.com (20.178.186.21) by
 SYCPR01MB5086.ausprd01.prod.outlook.com (20.178.187.213) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.2178.16; Mon, 19 Aug 2019 08:27:58 +0000
Received: from SYCPR01MB4701.ausprd01.prod.outlook.com
 ([fe80::283a:5b2a:d729:c84b]) by SYCPR01MB4701.ausprd01.prod.outlook.com
 ([fe80::283a:5b2a:d729:c84b%7]) with mapi id 15.20.2178.018; Mon, 19 Aug 2019
 08:27:58 +0000
From: Hendra Gunadi <hendra.gunadi@anu.edu.au>
To: "tiff@lists.osgeo.org" <tiff@lists.osgeo.org>
Thread-Topic: Possible Bug in Libtiff (tiff2pdf) when PLANARCONFIG in the
 Input is not PLANARCONFIG_CONTIG
Thread-Index: AQHVVmTghwNlmNFiB02miEo5EUf4iw==
Date: Mon, 19 Aug 2019 08:27:58 +0000
Message-ID: <SYBPR01MB4700B31406C9B2D8B1FD1413CAA80@SYBPR01MB4700.ausprd01.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
authentication-results: spf=none (sender IP is )
 smtp.mailfrom=hendra.gunadi@anu.edu.au; 
x-originating-ip: [150.203.212.102]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 0abfe28e-b01a-436c-9cb8-08d7247f245b
x-microsoft-antispam: BCL:0; PCL:0;
 RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020);
 SRVR:SYCPR01MB5086; 
x-ms-traffictypediagnostic: SYCPR01MB5086:
x-microsoft-antispam-prvs: <SYCPR01MB5086D8AEA78C512AB04E2CA7CAA80@SYCPR01MB5086.ausprd01.prod.outlook.com>
x-cricos: 00120C
x-ms-oob-tlc-oobclassifiers: OLM:3173;
x-forefront-prvs: 0134AD334F
x-forefront-antispam-report: SFV:NSPM;
 SFS:(10019020)(136003)(366004)(396003)(376002)(346002)(39860400002)(199004)(189003)(786003)(316002)(6116002)(3846002)(7736002)(6506007)(66066001)(2501003)(2906002)(25786009)(81166006)(54896002)(66446008)(52536014)(64756008)(66556008)(6512007)(88552002)(81156014)(1730700003)(74316002)(8676002)(76116006)(86362001)(5660300002)(66476007)(66946007)(33656002)(99286004)(6486002)(9686003)(5640700003)(2351001)(8936002)(6436002)(256004)(478600001)(14444005)(186003)(102836004)(26005)(476003)(44832011)(486006)(6606003)(6916009)(53936002)(71200400001)(71190400001)(19627405001)(14454004);
 DIR:OUT; SFP:1102; SCL:1; SRVR:SYCPR01MB5086;
 H:SYCPR01MB4701.ausprd01.prod.outlook.com; FPR:; SPF:None; LANG:en;
 PTR:InfoNoRecords; A:1; MX:1; 
received-spf: None (protection.outlook.com: anu.edu.au does not designate
 permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: dCF8582OpJgBLC3zW7nsBP23WT0W7BRUM5q49KHsw4tHbMG8S/zTWl6E+o7tJCdgFm6NLNt5DMmP7hJlIavuEQnBMUfBFbL1FDvn6ImyMhtszDfyBU0ro1bDzpezIDXEXGfdSEZ+2JTDJXCR5OZ2AoBPD9D241c2husynUZIL0SmurPtrMAYF2tJ/VUWPVA6sQSilBkNktutgwOVLy/BJDEl7kIzCJ/cpK0X51by+IxHdjwUTQRDF6TCFftt94PaUnxeIOkGXw2RtxGJ1/pOwzJUlbe1xeTih7USylaTF0opdSz/6EL1lbDX9EiMqXCvclOMdTjIYvLaBfi/pJjRYY8Xk9AsY3qoPKihT2nwIb9YugWMBz/BU7tvDO27CzgNG5g8VTdrfPvrBVUAO9/Xb6bc0fWaGlVqREXdKHFcfIU=
x-ms-exchange-transport-forked: True
MIME-Version: 1.0
X-OriginatorOrg: anu.edu.au
X-MS-Exchange-CrossTenant-Network-Message-Id: 0abfe28e-b01a-436c-9cb8-08d7247f245b
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Aug 2019 08:27:58.3505 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: e37d725c-ab5c-4624-9ae5-f0533e486437
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 4R0LqPk7TPckOU9YukgcHYscAEY7+Wa+2ZcQe1qUCDqE6OPkub00tR6ukGAqyP0nTiPTzVV5kAliLy/gPvzvPw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SYCPR01MB5086
Subject: [Tiff] Possible Bug in Libtiff (tiff2pdf) when PLANARCONFIG in the
 Input is not PLANARCONFIG_CONTIG
X-BeenThere: tiff@lists.osgeo.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.osgeo.org>
List-Unsubscribe: <https://lists.osgeo.org/mailman/options/tiff>,
 <mailto:tiff-request@lists.osgeo.org?subject=unsubscribe>
List-Post: <mailto:tiff@lists.osgeo.org>
List-Help: <mailto:tiff-request@lists.osgeo.org?subject=help>
List-Subscribe: <https://lists.osgeo.org/mailman/listinfo/tiff>,
 <mailto:tiff-request@lists.osgeo.org?subject=subscribe>
Content-Type: multipart/mixed; boundary="===============5341984719965253035=="
Errors-To: tiff-bounces@lists.osgeo.org
Sender: "Tiff" <tiff-bounces@lists.osgeo.org>
X-GND-Status: LEGIT
Received-SPF: pass (spool5: domain of lists.osgeo.org designates 140.211.15.3 as permitted sender) client-ip=140.211.15.3; envelope-from=tiff-bounces@lists.osgeo.org; helo=lists.osgeo.org;

--===============5341984719965253035==
Content-Language: en-US
Content-Type: multipart/alternative;
	boundary="_000_SYBPR01MB4700B31406C9B2D8B1FD1413CAA80SYBPR01MB4700ausp_"

--_000_SYBPR01MB4700B31406C9B2D8B1FD1413CAA80SYBPR01MB4700ausp_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Hi,


On my machine when triaging a fuzzing result on ASAN built 32-bit (v. 4.0.9=
) I encountered this error:


=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
=3D=3D9771=3D=3DERROR: AddressSanitizer: heap-buffer-overflow on address 0x=
f580027f at pc 0x080ea1dd bp 0xffffc948 sp 0xffffc520
READ of size 18 at 0xf580027f thread T0
    #0 0x80ea1dc in fwrite /home/hengunadi/building_llvm/llvm-project/compi=
ler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1105
    #1 0x8178f78 in t2p_writeproc /tiff-4.0.9/tools/tiff2pdf.c:405:21
    #2 0xf7f776d5 in TIFFAppendToStrip /tiff-4.0.9/libtiff/tif_write.c:771:=
7
    #3 0xf7f75c07 in TIFFWriteEncodedStrip /tiff-4.0.9/libtiff/tif_write.c:=
273:14
    #4 0x8195e20 in t2p_readwrite_pdf_image_tile /tiff-4.0.9/tools/tiff2pdf=
.c:3192:17
    #5 0x817b89e in t2p_write_pdf /tiff-4.0.9/tools/tiff2pdf.c:5544:16
    #6 0x8177eaf in main /tiff-4.0.9/tools/tiff2pdf.c:808:2
    #7 0xf7afae80 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18e=
80)
    #8 0x80619a1 in _start (/home/hendrag/llvm_asan/tiff409c710_debug_llvm_=
norm/debugbuild/bin/tiff2pdf+0x80619a1)

0xf580027f is located 0 bytes to the right of 15-byte region [0xf5800270,0x=
f580027f)
allocated by thread T0 here:
    #0 0x81320ef in malloc /home/hengunadi/building_llvm/llvm-project/compi=
ler-rt/lib/asan/asan_malloc_linux.cc:146
    #1 0xf7f7d17f in _TIFFmalloc /tiff-4.0.9/libtiff/tif_unix.c:316:10
    #2 0x8193a56 in t2p_readwrite_pdf_image_tile /tiff-4.0.9/tools/tiff2pdf=
.c:2973:30
    #3 0x817b89e in t2p_write_pdf /tiff-4.0.9/tools/tiff2pdf.c:5544:16
    #4 0x8177eaf in main /tiff-4.0.9/tools/tiff2pdf.c:808:2
    #5 0xf7afae80 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18e=
80)

Upon debugging, I suspect it is due to the fact that the input PLANARCONFIG=
 is not PLANARCONFIG_CONTIG,

hence, there is a mismatch in the buffer allocated to be written in the t2p=
_readwrite_pdf_image_tile, leading to heap-buffer-overread.

I'm aware that this is not triggered in the latest build, however, I still =
see there is a problematic line at tiff2pdf.c:3178.

The problem is that the PLANARCONFIG of the output is set to PLANARCONFIG_C=
ONTIG regardless of the input's.

FYI the latest build meaning commit ea2e933b17078a6517f1ee888ea4da72fa1104b=
1

As such, I want to confirm whether this is a bug.


Let me elaborate what happened on my machine:

  1.  tiff_datasize is assigned the size of the tile (TIFFVTileSize64). As =
PLANARCONFIG is not PLANARCONFIG_CONTIG, the branch is not hit and the retu=
rn value is 5.
  2.  When allocating the buffer in tiff2pdf.c:3020, it is based on the siz=
e of the tiff_datasize, which is 15 (derived from (1) )
  3.  This buffer is then used to be an input to function TIFFWriteEncodedS=
trip on tiff2pdf.c:3247
  4.  As an argument to TIFFWriteEncodedStrip, it calculates the size of th=
e output strip (TIFFVStripSize64). As PLANARCONFIG is PLANARCONFIG_CONTIG, =
the branch is hit and the return value is 6.
  5.  The derived size value is 18, which does not match 15 allocated. Henc=
e, buffer-over-read when trying to copy the 18 bytes from 15 bytes of input=
.

Regards,
Hendra




--_000_SYBPR01MB4700B31406C9B2D8B1FD1413CAA80SYBPR01MB4700ausp_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
<style type=3D"text/css" style=3D"display:none;"><!-- P {margin-top:0;margi=
n-bottom:0;} --></style>
</head>
<body dir=3D"ltr">
<div id=3D"divtagdefaultwrapper" style=3D"font-size:12pt;color:#000000;font=
-family:Calibri,Helvetica,sans-serif;" dir=3D"ltr">
<p style=3D"margin-top:0;margin-bottom:0">Hi,</p>
<p style=3D"margin-top:0;margin-bottom:0"><br>
</p>
<p style=3D"margin-top:0;margin-bottom:0">On my machine when triaging a fuz=
zing result on ASAN built 32-bit (v. 4.0.9) I encountered this error:</p>
<p style=3D"margin-top:0;margin-bottom:0"><br>
</p>
<p style=3D"margin-top:0;margin-bottom:0"></p>
<div>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br>
=3D=3D9771=3D=3DERROR: AddressSanitizer: heap-buffer-overflow on address 0x=
f580027f at pc 0x080ea1dd bp 0xffffc948 sp 0xffffc520<br>
READ of size 18 at 0xf580027f thread T0<br>
&nbsp;&nbsp;&nbsp; #0 0x80ea1dc in fwrite /home/hengunadi/building_llvm/llv=
m-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interce=
ptors.inc:1105<br>
&nbsp;&nbsp;&nbsp; #1 0x8178f78 in t2p_writeproc /tiff-4.0.9/tools/tiff2pdf=
.c:405:21<br>
&nbsp;&nbsp;&nbsp; #2 0xf7f776d5 in TIFFAppendToStrip /tiff-4.0.9/libtiff/t=
if_write.c:771:7<br>
&nbsp;&nbsp;&nbsp; #3 0xf7f75c07 in TIFFWriteEncodedStrip /tiff-4.0.9/libti=
ff/tif_write.c:273:14<br>
&nbsp;&nbsp;&nbsp; #4 0x8195e20 in t2p_readwrite_pdf_image_tile /tiff-4.0.9=
/tools/tiff2pdf.c:3192:17<br>
&nbsp;&nbsp;&nbsp; #5 0x817b89e in t2p_write_pdf /tiff-4.0.9/tools/tiff2pdf=
.c:5544:16<br>
&nbsp;&nbsp;&nbsp; #6 0x8177eaf in main /tiff-4.0.9/tools/tiff2pdf.c:808:2<=
br>
&nbsp;&nbsp;&nbsp; #7 0xf7afae80 in __libc_start_main (/lib/i386-linux-gnu/=
libc.so.6&#43;0x18e80)<br>
&nbsp;&nbsp;&nbsp; #8 0x80619a1 in _start (/home/hendrag/llvm_asan/tiff409c=
710_debug_llvm_norm/debugbuild/bin/tiff2pdf&#43;0x80619a1)<br>
<br>
0xf580027f is located 0 bytes to the right of 15-byte region [0xf5800270,0x=
f580027f)<br>
allocated by thread T0 here:<br>
&nbsp;&nbsp;&nbsp; #0 0x81320ef in malloc /home/hengunadi/building_llvm/llv=
m-project/compiler-rt/lib/asan/asan_malloc_linux.cc:146<br>
&nbsp;&nbsp;&nbsp; #1 0xf7f7d17f in _TIFFmalloc /tiff-4.0.9/libtiff/tif_uni=
x.c:316:10<br>
&nbsp;&nbsp;&nbsp; #2 0x8193a56 in t2p_readwrite_pdf_image_tile /tiff-4.0.9=
/tools/tiff2pdf.c:2973:30<br>
&nbsp;&nbsp;&nbsp; #3 0x817b89e in t2p_write_pdf /tiff-4.0.9/tools/tiff2pdf=
.c:5544:16<br>
&nbsp;&nbsp;&nbsp; #4 0x8177eaf in main /tiff-4.0.9/tools/tiff2pdf.c:808:2<=
br>
&nbsp;&nbsp;&nbsp; #5 0xf7afae80 in __libc_start_main (/lib/i386-linux-gnu/=
libc.so.6&#43;0x18e80)<br>
<br>
</div>
Upon debugging, I suspect it is due to the fact that the input PLANARCONFIG=
 is not PLANARCONFIG_CONTIG,
<p></p>
<p style=3D"margin-top:0;margin-bottom:0">hence, there is a mismatch in the=
 buffer allocated to be written in the
<span>t2p_readwrite_pdf_image_tile</span>, leading to heap-buffer-overread.=
</p>
<p style=3D"margin-top:0;margin-bottom:0">I'm aware that this is not trigge=
red in the latest build, however, I still see there is a problematic line a=
t tiff2pdf.c:3178.</p>
<p style=3D"margin-top:0;margin-bottom:0">The problem is that the PLANARCON=
FIG of the output is set to PLANARCONFIG_CONTIG regardless of the input's.<=
br>
</p>
<p style=3D"margin-top:0;margin-bottom:0">FYI the latest build meaning comm=
it <span>
ea2e933b17078a6517f1ee888ea4da72fa1104b1</span><br>
</p>
<p style=3D"margin-top:0;margin-bottom:0">As such, I want to confirm whethe=
r this is a bug.<br>
</p>
<p style=3D"margin-top:0;margin-bottom:0"><br>
</p>
<p style=3D"margin-top:0;margin-bottom:0">Let me elaborate what happened on=
 my machine:</p>
<ol style=3D"margin-bottom: 0px; margin-top: 0px;">
<li>tiff_datasize is assigned the size of the tile (TIFFVTileSize64). As PL=
ANARCONFIG is not PLANARCONFIG_CONTIG, the branch is not hit and the return=
 value is 5.</li><li>When allocating the buffer in tiff2pdf.c:3020, it is b=
ased on the size of the tiff_datasize, which is 15 (derived from (1) )</li>=
<li>This buffer is then used to be an input to function TIFFWriteEncodedStr=
ip on tiff2pdf.c:3247</li><li>As an argument to TIFFWriteEncodedStrip, it c=
alculates the size of the output strip (<span>TIFFVStripSize64</span>). As =
PLANARCONFIG is PLANARCONFIG_CONTIG, the branch is hit and the return value=
 is 6.</li><li>The derived size value is 18, which does not match 15 alloca=
ted. Hence, buffer-over-read when trying to copy the 18 bytes from 15 bytes=
 of input.</li></ol>
<div><br>
</div>
<div>Regards,</div>
<div>Hendra<br>
</div>
<p style=3D"margin-top:0;margin-bottom:0"><br>
</p>
<p style=3D"margin-top:0;margin-bottom:0"><br>
</p>
<p style=3D"margin-top:0;margin-bottom:0"><br>
</p>
</div>
</body>
</html>

--_000_SYBPR01MB4700B31406C9B2D8B1FD1413CAA80SYBPR01MB4700ausp_--

--===============5341984719965253035==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KVGlmZiBtYWls
aW5nIGxpc3QKVGlmZkBsaXN0cy5vc2dlby5vcmcKaHR0cHM6Ly9saXN0cy5vc2dlby5vcmcvbWFp
bG1hbi9saXN0aW5mby90aWZmCg==

--===============5341984719965253035==--

