CVE-2026-112395: Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

Summary

Pillow's libImaging decodeTile decoder, used to decode tiled TIFF images, allocates a per-tile buffer using realloc(state->buffer, TIFFTileSize(tiff)). After each TIFFReadTile it then iterates tiley from 0 up to currenttilelength and calls the configured row unpacker (here copy4) with the source pointer state->buffer + tiley rowbytesize. When libtiff returns a tilebytessize smaller than the worst-case rowbytesize tilelength, the inner stride-and-copy loop walks past the realloc'd region and copy4 performs a 1024-byte memcpy that reads up to (tilelength-1) rowbytesize + rowbytesize bytes from a buffer sized only to tilebytessize. The supplied PoC TIFF triggers a 1024-byte over-read exactly 0 bytes past a 196608-byte allocation. An attacker who can convince a Pillow-using application to decode a crafted TIFF can trigger a process crash (DoS) and may cause adjacent heap memory to be copied into the decoded pixel buffer.

Details

Pillow's TIFF decoder, when libtiff reports the file is tiled, takes the decodeTile path. The function:

1. Asks libtiff for TIFFTileSize(tiff) (the bytes-per-tile) and TIFFTileRowSize(tiff) (the bytes per row as stored by libtiff). 2. Reallocates state->buffer to exactly tilebytessize. 3. For each tile origin (x, y) and each plane, calls TIFFReadTile into state->buffer, then walks the tile row by row, calling the configured ImagingShuffler (here copy4) on each row's worth of source bytes.

The validation done before the loop is:

c if (tilebytessize > ((tilelength state->bits / planes + 7) / 8) tilewidth) { state->errcode = IMAGINGCODECBROKEN; return -1; }

This rejects oversized libtiff tiles, but it does not reject undersized ones — i.e. the case where libtiff returns a tilebytessize strictly less than rowbytesize tilelength. The loop body, however, indexes into the buffer assuming the buffer is at least rowbytesize tilelength bytes long.

Vulnerable Code

c // src/libImaging/TiffDecode.c:446-490 — decodeTile newdata = realloc(state->buffer, state->bytes); // bytes = tilebytessize if (!newdata) { ... } state->buffer = newdata;

for (y = state->yoff; y < state->ysize; y += tilelength) { for (plane = 0; plane < planes; plane++) { ImagingShuffler shuffler = unpackers[plane]; for (x = state->xoff; x < state->xsize; x += tilewidth) { if (TIFFReadTile(tiff, (tdatat)state->buffer, x, y, 0, plane) == -1) { ... }

currenttilewidth = min((INT32)tilewidth, state->xsize - x); currenttilelength = min((INT32)tilelength, state->ysize - y); for (tiley = 0; tiley < currenttilelength; tiley++) { shuffler( (UINT8 )im->image[tiley + y] + x im->pixelsize, state->buffer + tiley rowbytesize, // <-- OOB stride currenttilewidth ); } } } }

c // src/libImaging/Unpack.c:1288-1291 — copy4 (the crash site) static void copy4(UINT8 out, const UINT8 in, int pixels) { / RGBA, CMYK quadruples / memcpy(out, in, 4 pixels); // <-- ASAN-detected READ here }

The PoC's tile metadata yields tilewidth = tilelength = 256, rowbytesize = 1024 (4 bytes/pixel × 256 pixels), and tilebytessize = 196608 (which is 256·256·3 = three-channel-byte storage). The realloc'd buffer is 196608 bytes. The unpacker iterates tiley from 0 to 255 and for the highest rows the source pointer state->buffer + tiley 1024 already lies at or past offset 196608 — the very last row's memcpy(in=buffer+255·1024, 1024) reads 1024 bytes starting 260096 - 196608 = 63488 bytes past the allocation; ASAN flags the very first byte past the heap region (READ of size 1024 at … 0 bytes after 196608-byte region).

The mismatch is real: libtiff's TIFFTileSize returns the packed per-tile storage (which depends on the file's photometric/separation layout — it can legitimately be smaller than rowbytesize × tilelength), while the inner loop strides as if the buffer always equals rowbytesize × tilelength.

Attribution

This issue was found by Anthropic from using Claude to study security of open source projects, and I am from Ada Logics helping validate the found issues and report to maintainers. The data in this report has been reviewed manually.