Bugzilla – Bug 1042804
VUL-1: CVE-2017-9404: libtiff: Memory leak in OJPEGReadHeaderInfoSecTablesQTable
Last modified: 2018-11-14 13:19:16 UTC
rh#1458904 In LibTIFF 4.0.7, a memory leak vulnerability was found in the function OJPEGReadHeaderInfoSecTablesQTable in tif_ojpeg.c, which allows attackers to cause a denial of service via a crafted file. References: https://bugzilla.redhat.com/show_bug.cgi?id=1458904 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9404 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9404 http://bugzilla.maptools.org/show_bug.cgi?id=2688
SUSE-SU-2017:2569-1: An update that fixes 14 vulnerabilities is now available. Category: security (moderate) Bug References: 1033109,1033111,1033112,1033113,1033118,1033120,1033126,1033127,1033128,1033129,1033131,1038438,1042804,1042805 CVE References: CVE-2016-10371,CVE-2017-7592,CVE-2017-7593,CVE-2017-7594,CVE-2017-7595,CVE-2017-7596,CVE-2017-7597,CVE-2017-7598,CVE-2017-7599,CVE-2017-7600,CVE-2017-7601,CVE-2017-7602,CVE-2017-9403,CVE-2017-9404 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP3 (src): tiff-4.0.8-44.3.1 SUSE Linux Enterprise Software Development Kit 12-SP2 (src): tiff-4.0.8-44.3.1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src): tiff-4.0.8-44.3.1 SUSE Linux Enterprise Server 12-SP3 (src): tiff-4.0.8-44.3.1 SUSE Linux Enterprise Server 12-SP2 (src): tiff-4.0.8-44.3.1 SUSE Linux Enterprise Desktop 12-SP3 (src): tiff-4.0.8-44.3.1 SUSE Linux Enterprise Desktop 12-SP2 (src): tiff-4.0.8-44.3.1
openSUSE-SU-2017:2635-1: An update that fixes 14 vulnerabilities is now available. Category: security (moderate) Bug References: 1033109,1033111,1033112,1033113,1033118,1033120,1033126,1033127,1033128,1033129,1033131,1038438,1042804,1042805 CVE References: CVE-2016-10371,CVE-2017-7592,CVE-2017-7593,CVE-2017-7594,CVE-2017-7595,CVE-2017-7596,CVE-2017-7597,CVE-2017-7598,CVE-2017-7599,CVE-2017-7600,CVE-2017-7601,CVE-2017-7602,CVE-2017-9403,CVE-2017-9404 Sources used: openSUSE Leap 42.3 (src): tiff-4.0.8-21.1 openSUSE Leap 42.2 (src): tiff-4.0.8-17.6.1
4.0.10, 4.0.9 with ASAN $ tiff2ps memory-leak-OJPEGReadHeaderInfoSecTablesQTable-tiff2ps-1.tif > /dev/null TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order. TIFFReadDirectory: Warning, Unknown field with tag 552 (0x228) encountered. TIFFReadDirectory: Warning, Unknown field with tag 4625 (0x1211) encountered. TIFFFetchNormalTag: Warning, Incorrect count for "SubfileType"; tag ignored. TIFFFetchNormalTag: Warning, Incorrect count for "YResolution"; tag ignored. _TIFFVSetField: memory-leak-OJPEGReadHeaderInfoSecTablesQTable-tiff2ps-1.tif: Bad value 0 for "ResolutionUnit" tag. TIFFFetchNormalTag: Warning, Incorrect count for "JpegInterchangeFormat"; tag ignored. TIFFFetchNormalTag: Warning, Incorrect count for "JpegInterchangeFormatLength"; tag ignored. TIFFFetchNormalTag: Warning, Incorrect count for "JpegRestartInterval"; tag ignored. TIFFFetchNormalTag: Warning, Sanity check on size of "Tag 4625" value failed; tag ignored. TIFFFetchNormalTag: Warning, incorrect count for field "YCbCrSubsampling", expected 2, got 66. TIFFFetchNormalTag: Warning, Incorrect count for "YCbCrPositioning"; tag ignored. TIFFSetField: memory-leak-OJPEGReadHeaderInfoSecTablesQTable-tiff2ps-1.tif: Unknown pseudo-tag 65538. memory-leak-OJPEGReadHeaderInfoSecTablesQTable-tiff2ps-1.tif: Inconsistent value of es: 0. $ 3.8.2: valgrind does not show any memory leak either.
4.0.7: ================================================================= ==2166==ERROR: LeakSanitizer: detected memory leaks Direct leak of 73 byte(s) in 1 object(s) allocated from: #0 0x7faea6c00ed0 in malloc (/usr/lib64/libasan.so.5+0xebed0) #1 0x7faea7aa9db1 in _TIFFmalloc /usr/src/debug/tiff-4.0.7-0.x86_64/libtiff/tif_unix.c:316 #2 0x7faea7a6fda2 in OJPEGReadHeaderInfoSecTablesQTable /usr/src/debug/tiff-4.0.7-0.x86_64/libtiff/tif_ojpeg.c:1770 #3 0x7faea7a6c3dc in OJPEGReadHeaderInfoSec /usr/src/debug/tiff-4.0.7-0.x86_64/libtiff/tif_ojpeg.c:1360 #4 0x7faea7a68f5b in OJPEGReadHeaderInfo /usr/src/debug/tiff-4.0.7-0.x86_64/libtiff/tif_ojpeg.c:1086 #5 0x7faea7a651ea in OJPEGPreDecode /usr/src/debug/tiff-4.0.7-0.x86_64/libtiff/tif_ojpeg.c:674 #6 0x7faea7a99f17 in TIFFStartStrip /usr/src/debug/tiff-4.0.7-0.x86_64/libtiff/tif_read.c:1023 #7 0x7faea7a97c57 in TIFFFillStrip /usr/src/debug/tiff-4.0.7-0.x86_64/libtiff/tif_read.c:647 #8 0x7faea7a95d20 in TIFFSeek /usr/src/debug/tiff-4.0.7-0.x86_64/libtiff/tif_read.c:233 #9 0x7faea7a960e8 in TIFFReadScanline /usr/src/debug/tiff-4.0.7-0.x86_64/libtiff/tif_read.c:300 #10 0x55d6f509db0a in PSDataColorContig /usr/src/debug/tiff-4.0.7-0.x86_64/tools/tiff2ps.c:2449 #11 0x55d6f509d5b7 in PSpage /usr/src/debug/tiff-4.0.7-0.x86_64/tools/tiff2ps.c:2347 #12 0x55d6f509998f in TIFF2PS /usr/src/debug/tiff-4.0.7-0.x86_64/tools/tiff2ps.c:1606 #13 0x55d6f509409d in main /usr/src/debug/tiff-4.0.7-0.x86_64/tools/tiff2ps.c:473 #14 0x7faea63e4fea in __libc_start_main (/lib64/libc.so.6+0x22fea) SUMMARY: AddressSanitizer: 73 byte(s) leaked in 1 allocation(s). This points to allocation memory for `ob' and to following changes between 4.0.7 and 4.0.8 in tiff_ojpeg.c: @@ -1782,7 +1790,12 @@ OJPEGReadHeaderInfoSecTablesQTable(TIFF* TIFFSeekFile(tif,sp->qtable_offset[m],SEEK_SET); p=(uint32)TIFFReadFile(tif,&ob[sizeof(uint32)+5],64); if (p!=64) + { + _TIFFfree(ob); return(0); + } + if (sp->qtable[m]!=0) + _TIFFfree(sp->qtable[m]); sp->qtable[m]=ob; sp->sof_tq[m]=m; } @@ -1846,7 +1859,12 @@ OJPEGReadHeaderInfoSecTablesDcTable(TIFF rb[sizeof(uint32)+5+n]=o[n]; p=(uint32)TIFFReadFile(tif,&(rb[sizeof(uint32)+21]),q); if (p!=q) + { + _TIFFfree(rb); return(0); + } + if (sp->dctable[m]!=0) + _TIFFfree(sp->dctable[m]); sp->dctable[m]=rb; sp->sos_tda[m]=(m<<4); } @@ -1910,7 +1928,12 @@ OJPEGReadHeaderInfoSecTablesAcTable(TIFF rb[sizeof(uint32)+5+n]=o[n]; p=(uint32)TIFFReadFile(tif,&(rb[sizeof(uint32)+21]),q); if (p!=q) + { + _TIFFfree(rb); return(0); + } + if (sp->actable[m]!=0) + _TIFFfree(sp->actable[m]); sp->actable[m]=rb; sp->sos_tda[m]=(sp->sos_tda[m]|m); } While I do not see such code in 3.8.2 and given I can not reproduce the leak using valgrind there, I consider 11/tiff and 10sp3/tiff unaffected.
SLE12 only, fixed.