CVE-2016-9539: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: tools/tiffcrop.c in libtiff 4.0.6 has an out-of-bounds read in readContigTilesIntoBuffer(). Reported as MSVR 35092.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2016-11-22T19:59Z
Repository: https://github.com/vadz/libtiff
Language: Other
Files changed: ChangeLog, tools/tiffcrop.c
Commit date: 2016-10-14 19:13:20 +0000
Commit message: * tools/tiffcrop.c: fix out-of-bound read of up to 3 bytes in
readContigTilesIntoBuffer(). Reported as MSVR 35092 by Axel Souchet
& Vishal Chauhan from the MSRC Vulnerabilities & Mitigations team.

Diff: diff --git a/ChangeLog b/ChangeLog
index d6e718de1..84d016d72 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,11 @@
+2016-10-14 Even Rouault <even.rouault at spatialys.com>
+
+	* tools/tiffcrop.c: fix out-of-bound read of up to 3 bytes in
+	readContigTilesIntoBuffer(). Reported as MSVR 35092 by Axel Souchet
+	& Vishal Chauhan from the MSRC Vulnerabilities & Mitigations team.
+
 2016-10-09 Even Rouault <even.rouault at spatialys.com>
 
 	* tools/tiff2pdf.c: fix write buffer overflow of 2 bytes on JPEG
 	compressed images. Reported by Tyler Bohan of Cisco Talos as
 	TALOS-CAN-0187 / CVE-2016-5652.
diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
index eb6de77cb..471773735 100644
--- a/tools/tiffcrop.c
+++ b/tools/tiffcrop.c
@@ -817,13 +817,22 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8* buf,
     	TIFFError("readContigTilesIntoBuffer", "Integer overflow when calculating buffer size.");
         exit(-1);
     }
     }
 
-  tilebuf = _TIFFmalloc(tile_buffsize);
+  /* Add 3 padding bytes for extractContigSamplesShifted32bits */
+  if( tile_buffsize > 0xFFFFFFFFU - 3 )
+  {
+      TIFFError("readContigTilesIntoBuffer", "Integer overflow when calculating buffer size.");
+      exit(-1);
+  }
+  tilebuf = _TIFFmalloc(tile_buffsize + 3);
   if (tilebuf == 0)
     return 0;
+  tilebuf[tile_buffsize] = 0;
+  tilebuf[tile_buffsize+1] = 0;
+  tilebuf[tile_buffsize+2] = 0;
 
   dst_rowsize = ((imagewidth * bps * spp) + 7) / 8;  
   for (row = 0; row < imagelength; row += tl)
     {
     nrow = (row + tl > imagelength) ? imagelength - row : tl;

Vulnerable code:   tilebuf = _TIFFmalloc(tile_buffsize);
Fixed code: 2016-10-14 Even Rouault <even.rouault at spatialys.com>

	* tools/tiffcrop.c: fix out-of-bound read of up to 3 bytes in
	readContigTilesIntoBuffer(). Reported as MSVR 35092 by Axel Souchet
	& Vishal Chauhan from the MSRC Vulnerabilities & Mitigations team.

  /* Add 3 padding bytes for extractContigSamplesShifted32bits */
  if( tile_buffsize > 0xFFFFFFFFU - 3 )
  {
      TIFFError("readContigTilesIntoBuffer", "Integer overflow when calculating buffer size.");
      exit(-1);
  }
  tilebuf = _TIFFmalloc(tile_buffsize + 3);
  tilebuf[tile_buffsize] = 0;
  tilebuf[tile_buffsize+1] = 0;
  tilebuf[tile_buffsize+2] = 0;