Return-Path: <awaresystems.be+caf_=filtered=awaresystems.be@gmail.com>
Delivered-To: filtered@awaresystems.be
Received: from mx4.public.one.com ([10.246.18.24])
	by mail6.local.one.com (Dovecot) with LMTP id J/5qKIuqI1hmgwAAsyOMew
	for <filtered@awaresystems.be>; Wed, 09 Nov 2016 23:03:57 +0000
X-HalOne-ID: caaa5042-a6d0-11e6-9067-b82a72d0454d
Received: from mail-it0-f41.google.com (unknown [209.85.214.41])
	by mx4.public.one.com (Halon Mail Gateway) with ESMTPS
	for <filtered@awaresystems.be>; Wed,  9 Nov 2016 23:03:56 +0000 (UTC)
Received: by mail-it0-f41.google.com with SMTP id e187so230054570itc.0
        for <filtered@awaresystems.be>; Wed, 09 Nov 2016 15:03:56 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=x-original-authentication-results:x-gm-message-state:delivered-to
         :from:to:date:user-agent:references:in-reply-to:mime-version
         :message-id:subject:precedence:list-id:list-unsubscribe:list-archive
         :list-post:list-help:list-subscribe:content-transfer-encoding:sender
         :errors-to;
        bh=8Mowz2dd4PzhwfIvBMfN76w8oR6Vrbs+70RFaQmwjdQ=;
        b=jg9/e4CzlkllnIxyNMFH4uNoh2ub0Vp/e6hvDk3EkXwIDDjYrpZ3Qs8YeZgJoEL0DE
         +dEGChFPgBTdAvyuhIX/fLGZrMqnFq9Bi/w9GpfVt1f41o5WNkLsOBnq1mQXD+0+0nDe
         OiVWZmZdF4p5RF8E+0yKddRpSg3rdrz9R114mJ3gWdwO6rvf/7+S8MeKIHU6VigUJY3r
         BCM7zmV2KdG0w2HrOL1mYWbck/R+7pXeS00jw+6B2EjY87za4Z288Rnr2XgJS77PVsc1
         EsgBSmPhRPQtayj3zeLPyqV+zG1p6t2DxK6wU05fcgADTarr0vQpKBNrRfAXXSIuWh/s
         5tEA==
X-Original-Authentication-Results: mx.google.com;       spf=neutral (google.com: 94.23.4.142 is neither permitted nor denied by best guess record for domain of tiff-bounces@lists.maptools.org) smtp.mailfrom=tiff-bounces@lists.maptools.org
X-Gm-Message-State: ABUngvePaLSOm1FAgXqW3RgKKWfUyeA0287blF0mgZTWlr+0NVsuP3oK/rdpxW8S5fJ6FbjqNMAXYlXKiDWze37QVJTslgE=
X-Received: by 10.157.18.206 with SMTP id g72mr1026712otg.123.1478732632565;
        Wed, 09 Nov 2016 15:03:52 -0800 (PST)
X-Forwarded-To: filtered@awaresystems.be
X-Forwarded-For: awaresystems.be@gmail.com filtered@awaresystems.be
Delivered-To: awaresystems.be@gmail.com
Received: by 10.202.192.135 with SMTP id q129csp588831oif;
        Wed, 9 Nov 2016 15:03:51 -0800 (PST)
X-Received: by 10.28.29.86 with SMTP id d83mr2601852wmd.75.1478732631290;
        Wed, 09 Nov 2016 15:03:51 -0800 (PST)
Return-Path: <tiff-bounces@lists.maptools.org>
Received: from lists.maptools.org (ks365428.kimsufi.com. [94.23.4.142])
        by mx.google.com with ESMTP id e4si1940303wji.287.2016.11.09.15.03.50;
        Wed, 09 Nov 2016 15:03:51 -0800 (PST)
Received-SPF: neutral (google.com: 94.23.4.142 is neither permitted nor denied by best guess record for domain of tiff-bounces@lists.maptools.org) client-ip=94.23.4.142;
Authentication-Results: mx.google.com;
       spf=neutral (google.com: 94.23.4.142 is neither permitted nor denied by best guess record for domain of tiff-bounces@lists.maptools.org) smtp.mailfrom=tiff-bounces@lists.maptools.org
Received: from [10.1.0.241] (localhost.localdomain [127.0.0.1])
	by lists.maptools.org (Postfix) with ESMTP id E52C135C032;
	Wed,  9 Nov 2016 18:02:56 -0500 (EST)
Received: from smtp5-g21.free.fr (smtp5-g21.free.fr [212.27.42.5])
	by lists.maptools.org (Postfix) with ESMTPS id B48DE35C030
	for <tiff@lists.maptools.org>; Wed,  9 Nov 2016 18:02:43 -0500 (EST)
Received: from even-desktop.localnet (unknown [88.162.84.61])
	by smtp5-g21.free.fr (Postfix) with ESMTPS id C20EB5FF7A;
	Thu, 10 Nov 2016 00:02:42 +0100 (CET)
From: Even Rouault <even.rouault@spatialys.com>
To: tiff@lists.maptools.org
Date: Thu, 10 Nov 2016 00:03:54 +0100
User-Agent: KMail/1.13.5 (Linux/2.6.32-67-generic; KDE/4.4.5; x86_64; ; )
References: <20161109172256.GB24418@tunkki>
In-Reply-To: <20161109172256.GB24418@tunkki>
MIME-Version: 1.0
Message-Id: <201611100003.54350.even.rouault@spatialys.com>
Subject: Re: [Tiff] comments about bugs 2581 and 2587
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=subscribe>
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org

Le mercredi 09 novembre 2016 18:22:56, Henri Salo a =E9crit :
> New security related issue reported in:
> =

> http://bugzilla.maptools.org/show_bug.cgi?id=3D2581
> =

> with CVE request in:
> =

> http://www.openwall.com/lists/oss-security/2016/11/09/13

It looks to me it is an issue with address sanitizer itself that cannot han=
dle =

allocation attempts of 17 GB, but when running in normal conditions (and un=
der =

Valgrind too), the realloc() fails properly (or might succeed if you have a =

huge amout of RAM) properly.
One could discuss if libtiff should do such huge allocations but that's a =

tricky subject...

> =

> Can't reproduce this issue anymore with the latest codebase so maybe this
> case can just be closed:
> =

> http://bugzilla.maptools.org/show_bug.cgi?id=3D2587

No crash, but Valgrind isn't happy:

=3D=3D15186=3D=3D Invalid read of size 8
=3D=3D15186=3D=3D    at 0x401E87: cpStrips (tiffsplit.c:246)
=3D=3D15186=3D=3D    by 0x401DC2: tiffcp (tiffsplit.c:227)
=3D=3D15186=3D=3D    by 0x401066: main (tiffsplit.c:89)
=3D=3D15186=3D=3D  Address 0x5f381f8 is 0 bytes after a block of size 8 all=
oc'd
=3D=3D15186=3D=3D    at 0x4C274A8: malloc (vg_replace_malloc.c:236)
=3D=3D15186=3D=3D    by 0x4C27522: realloc (vg_replace_malloc.c:525)
=3D=3D15186=3D=3D    by 0x4E8DD38: _TIFFrealloc (tif_unix.c:328)
=3D=3D15186=3D=3D    by 0x4E35A98: _TIFFCheckRealloc (tif_aux.c:73)
=3D=3D15186=3D=3D    by 0x4E35B25: _TIFFCheckMalloc (tif_aux.c:88)
=3D=3D15186=3D=3D    by 0x4E4C97E: ChopUpSingleUncompressedStrip (tif_dirre=
ad.c:5533)
=3D=3D15186=3D=3D    by 0x4E485E9: TIFFReadDirectory (tif_dirread.c:4046)
=3D=3D15186=3D=3D    by 0x4E7AF7C: TIFFClientOpen (tif_open.c:466)
=3D=3D15186=3D=3D    by 0x4E8DBA2: TIFFFdOpen (tif_unix.c:211)
=3D=3D15186=3D=3D    by 0x4E8DCB8: TIFFOpen (tif_unix.c:250)
=3D=3D15186=3D=3D    by 0x400F7C: main (tiffsplit.c:71)
=3D=3D15186=3D=3D =

=3D=3D15186=3D=3D Invalid read of size 8
=3D=3D15186=3D=3D    at 0x401EEE: cpStrips (tiffsplit.c:252)
=3D=3D15186=3D=3D    by 0x401DC2: tiffcp (tiffsplit.c:227)
=3D=3D15186=3D=3D    by 0x401066: main (tiffsplit.c:89)
=3D=3D15186=3D=3D  Address 0x5f381f8 is 0 bytes after a block of size 8 all=
oc'd
=3D=3D15186=3D=3D    at 0x4C274A8: malloc (vg_replace_malloc.c:236)
=3D=3D15186=3D=3D    by 0x4C27522: realloc (vg_replace_malloc.c:525)
=3D=3D15186=3D=3D    by 0x4E8DD38: _TIFFrealloc (tif_unix.c:328)
=3D=3D15186=3D=3D    by 0x4E35A98: _TIFFCheckRealloc (tif_aux.c:73)
=3D=3D15186=3D=3D    by 0x4E35B25: _TIFFCheckMalloc (tif_aux.c:88)
=3D=3D15186=3D=3D    by 0x4E4C97E: ChopUpSingleUncompressedStrip (tif_dirre=
ad.c:5533)
=3D=3D15186=3D=3D    by 0x4E485E9: TIFFReadDirectory (tif_dirread.c:4046)
=3D=3D15186=3D=3D    by 0x4E7AF7C: TIFFClientOpen (tif_open.c:466)
=3D=3D15186=3D=3D    by 0x4E8DBA2: TIFFFdOpen (tif_unix.c:211)
=3D=3D15186=3D=3D    by 0x4E8DCB8: TIFFOpen (tif_unix.c:250)
=3D=3D15186=3D=3D    by 0x400F7C: main (tiffsplit.c:71)
=3D=3D15186=3D=3D =

TIFFReadRawStrip: 1: Strip out of range, max 1.

I've pushed a fix for that.

-- =

Spatialys - Geospatial professional services
http://www.spatialys.com
_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
