Details ======= Product: libtiff Affected Versions: <= 4.0.6 Vulnerability Type: illegel read Vendor URL: http://www.remotesensing.org/libtiff/ Credit: Kaixiang Zhang of the Cloud Security Team, Qihoo 360 CVE ID: CVE-2016-5321 Tested system version: fedora23 32bit fedora23 64bit CentOS Linux release 7.1.1503 64bit Introduction ======= It was always corrupted when I use tiffcrop command followed by a crafted TIFF image.The vulnerbility exists in fuction DumpModeDecode() whitout checking the value of output parameters, Attackers could exploit this issue to cause denial-of-service. Here is the stack info: gdb –args ./tiffcrop DumpModeDecode.tif tmpout.tif --- --- __memcpy_ssse3_back () at ../sysdeps/x86_64/multiarch/memcpy-ssse3-back.S:2709 2709 movdqu %xmm0, 36(%rdi) Program received signal SIGSEGV, Segmentation fault. __memcpy_ssse3_back () at ../sysdeps/x86_64/multiarch/memcpy-ssse3-back.S:2709 2709 movdqu %xmm0, 36(%rdi) (gdb) bt #0 __memcpy_ssse3_back () at ../sysdeps/x86_64/multiarch/memcpy-ssse3-back.S:2709 #1 0x00007ffff7ad6a79 in DumpModeDecode (tif=0x662010, buf=<optimized out>, cc=52, s=<optimized out>) at tif_dumpmode.c:103 #2 0x00007ffff7ba3739 in TIFFReadEncodedTile (tif=tif@entry=0x662010, tile=8, buf=0x0, size=52, size@entry=-1) at tif_read.c:668 #3 0x00007ffff7ba3a01 in TIFFReadTile (tif=tif@entry=0x662010, buf=<optimized out>, x=x@entry=0, y=y@entry=0, z=z@entry=0, s=s@entry=8) at tif_read.c:641 #4 0x0000000000443e41 in readSeparateTilesIntoBuffer (bps=208, spp=9, tl=1, tw=2, imagewidth=2, imagelength=1, obuf=0x662ce0 "200177335367377177", in=0x662010) at tiffcrop.c:994 #5 loadImage (in=in@entry=0x662010, image=image@entry=0x7fffffff7960, dump=dump@entry=0x7fffffffc270, read_ptr=read_ptr@entry=0x7fffffff7920) at tiffcrop.c:6079 #6 0x0000000000403209 in main (argc=<optimized out>, argv=<optimized out>) at tiffcrop.c:2278 (gdb) p buf $6 = 0x0