Details
=======
Product: libtiff
Affected Versions: <= 4.0.6
Vulnerability Type: divide by zero
Vendor URL: http://www.remotesensing.org/libtiff/
Credit: Kaixiang Zhang of the Cloud Security Team, Qihoo 360
CVE ID: CVE-2016-5323
Tested system version:
fedora23 32bit
fedora23 64bit
CentOS Linux release 7.1.1503 64bit
Introduction
=======
t was always corrupted when I use tiffcrop command followed by a crafted TIFF image in function _TIFFFax3fillruns ()
without checking the value of divisor, it causes a divide by zero flaw. Attackers cound exploit this issue to cause
denial-of-service.
Here is the stack info:
gdb –args ./tiffcrop _TIFFFax3fillruns.tif tmpout.tif
--- ---
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7ad97f0 in _TIFFFax3fillruns (buf=0x0, runs=0x673500, erun=<optimized out>, lastx=64) at tif_fax3.c:407
407 ZERO(n, cp);
(gdb) bt
#0 0x00007ffff7ad97f0 in _TIFFFax3fillruns (buf=0x0, runs=0x673500, erun=<optimized out>, lastx=64) at tif_fax3.c:407
#1 0x00007ffff7ae087c in Fax3DecodeRLE (tif=0x662010, buf=0x0, occ=8192, s=<optimized out>) at tif_fax3.c:1527
#2 0x00007ffff7ba3739 in TIFFReadEncodedTile (tif=tif@entry=0x662010, tile=8, buf=0x0, size=8192, size@entry=-1) at
tif_read.c:668
#3 0x00007ffff7ba3a01 in TIFFReadTile (tif=tif@entry=0x662010, buf=<optimized out>, x=x@entry=0, y=y@entry=0,
z=z@entry=0, s=s@entry=8) at tif_read.c:641
#4 0x0000000000443e41 in readSeparateTilesIntoBuffer (bps=1, spp=129, tl=1024, tw=64, imagewidth=32, imagelength=32,
obuf=0x7ffff7ee5010 "", in=0x662010) at tiffcrop.c:994
#5 loadImage (in=in@entry=0x662010, image=image@entry=0x7fffffff7960, dump=dump@entry=0x7fffffffc270,
read_ptr=read_ptr@entry=0x7fffffff7920) at tiffcrop.c:6079
#6 0x0000000000403209 in main (argc=<optimized out>, argv=<optimized out>) at tiffcrop.c:2278
(gdb) p cp
$2 = (unsigned char *) 0x0