REDHAT-BUG-2531414: Buffer Overflow
An AddressSanitizer (ASan)-confirmed heap-buffer overflow exists in the tiff2pdf utility of libtiff (tested on version 4.5.0). The vulnerability is triggered during the processing of crafted BigTIFF files, leading to a massive out-of-bounds memory copy that causes a crash and presents a severe memory corruption risk.
Technical Details
The root cause is an integer truncation flaw located in the JPEG raw passthrough path within tools/tiff2pdf.c, specifically in the t2preadwritepdfimage() function.When parsing BigTIFF files, StripByteCounts values are correctly read as 64-bit unsigned integers (uint64t). However, the variable used to track the maximum strip length—maxstriplength—is declared as a 32-bit unsigned integer (uint32t). If an attacker provides a crafted BigTIFF file with a StripByteCounts value exceeding the 32-bit limit, the value is truncated upon assignment to maxstriplength.This truncation results in an undersized heap allocation. Subsequently, TIFFReadRawStrip(..., -1) attempts to copy the full 64-bit strip byte count into this inadequate buffer, resulting in a heap-based buffer overflow that can exceed 4GB.
Affected VersionsVulnerable:
libtiff versions 3.9.0 through 4.7.0.
Fixed: libtiff version 4.7.1.
Upstream Status and RemediationUpstream developers have addressed this issue in version 4.7.1 by changing the data type of maxstriplength from uint32t to uint64t.
Note for Downstream Maintainers: The upstream libtiff project policy focuses on maintaining the current source tree and issuing new releases rather than backporting patches to legacy versions.
Commit: https://gitlab.com/libtiff/libtiff/-/commit/67fd283d276f09db54dc39b9ef7b979d4b45c4b1Merge Request (!729): https://gitlab.com/libtiff/libtiff/-/mergerequests/729
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libtiffto a version that resolves this vulnerability.Fixed in 4.7.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 729 - Operational
If libtiff parsing tools (e.g., tiff2pdf) processed crafted BigTIFF files, assume a potential crash/memory corruption and restart the affected process and re-run any impacted jobs using updated libtiff 4.7.1.
Event History
Frequently Asked Questions
What conditions are required to trigger the overflow?
The tiff2pdf utility must process an attacker-crafted BigTIFF file through its JPEG raw passthrough path. The file needs a StripByteCounts value larger than the 32-bit limit, causing the strip-length value to be truncated before allocation.
Is libtiff 4.5.0 affected?
Yes. The issue was tested and confirmed in libtiff version 4.5.0.
What is the immediate operational risk when the flaw is triggered?
Processing the malicious file can crash tiff2pdf. The undersized allocation is followed by a raw strip copy using the full 64-bit byte count, producing heap memory corruption that can exceed 4 GB.