CVE-2016-9540: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: tools/tiffcp.c in libtiff 4.0.6 has an out-of-bounds write on tiled images with odd tile width versus image width. Reported as MSVR 35103, aka "cpStripToTile heap-buffer-overflow."
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2016-11-22T19:59Z
Repository: https://github.com/vadz/libtiff
Language: Other
Files changed: ChangeLog, tools/tiffcp.c
Commit date: 2016-10-08 15:54:56 +0000
Commit message: * tools/tiffcp.c: fix out-of-bounds write on tiled images with odd
tile width vs image width. Reported as MSVR 35103
by Axel Souchet and Vishal Chauhan from the MSRC Vulnerabilities &
Mitigations team.

Diff: diff --git a/ChangeLog b/ChangeLog
index 8b57d1b18..d38f3a51c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
+2016-10-08 Even Rouault <even.rouault at spatialys.com>
+
+	* tools/tiffcp.c: fix out-of-bounds write on tiled images with odd
+	tile width vs image width. Reported as MSVR 35103
+	by Axel Souchet and Vishal Chauhan from the MSRC Vulnerabilities &
+	Mitigations team.
+
 2016-10-08 Even Rouault <even.rouault at spatialys.com>
 
 	* tools/tiff2pdf.c: fix read -largely- outsize of buffer in
 	t2p_readwrite_pdf_image_tile(), causing crash, when reading a
 	JPEG compressed image with TIFFTAG_JPEGTABLES length being one.
diff --git a/tools/tiffcp.c b/tools/tiffcp.c
index 4ad74d391..a99c9064d 100644
--- a/tools/tiffcp.c
+++ b/tools/tiffcp.c
@@ -1336,11 +1336,11 @@ DECLAREreadFunc(readContigTilesIntoBuffer)
 	for (row = 0; row < imagelength; row += tl) {
 		uint32 nrow = (row+tl > imagelength) ? imagelength-row : tl;
 		uint32 colb = 0;
 		uint32 col;
 
-		for (col = 0; col < imagewidth; col += tw) {
+		for (col = 0; col < imagewidth && colb < imagew; col += tw) {
 			if (TIFFReadTile(in, tilebuf, col, row, 0, 0) < 0
 			    && !ignore) {
 				TIFFError(TIFFFileName(in),
 				    "Error, can't read tile at %lu %lu",
 				    (unsigned long) col,
@@ -1521,11 +1521,11 @@ DECLAREwriteFunc(writeBufferToContigTiles)
 	for (row = 0; row < imagelength; row += tilelength) {
 		uint32 nrow = (row+tl > imagelength) ? imagelength-row : tl;
 		uint32 colb = 0;
 		uint32 col;
 
-		for (col = 0; col < imagewidth; col += tw) {
+		for (col = 0; col < imagewidth && colb < imagew; col += tw) {
 			/*
 			 * Tile is clipped horizontally.  Calculate
 			 * visible portion and skewing factors.
 			 */
 			if (colb + tilew > imagew) {

Vulnerable code: 		for (col = 0; col < imagewidth; col += tw) {
		for (col = 0; col < imagewidth; col += tw) {
Fixed code: 2016-10-08 Even Rouault <even.rouault at spatialys.com>

	* tools/tiffcp.c: fix out-of-bounds write on tiled images with odd
	tile width vs image width. Reported as MSVR 35103
	by Axel Souchet and Vishal Chauhan from the MSRC Vulnerabilities &
	Mitigations team.

		for (col = 0; col < imagewidth && colb < imagew; col += tw) {
		for (col = 0; col < imagewidth && colb < imagew; col += tw) {