CVE-2016-10093: Integer Overflow or Wraparound (CWE-190)
value: Integer overflow in tools/tiffcp.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5 and 4.0.6 allows remote attackers to have unspecified impact via a crafted image, which triggers a heap-based buffer overflow.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.8
Published: 2017-03-01T15:59Z
Repository: https://github.com/vadz/libtiff
Language: Other
Files changed: ChangeLog, tools/tiffcp.c
Commit date: 2016-12-03 16:40:01 +0000
Commit message: * tools/tiffcp.c: fix uint32 underflow/overflow that can cause heap-based
buffer overflow.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2610

Diff: diff --git a/ChangeLog b/ChangeLog
index 94be03859..8ee76c0ad 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
+2016-12-03 Even Rouault <even.rouault at spatialys.com>
+
+	* tools/tiffcp.c: fix uint32 underflow/overflow that can cause heap-based
+	buffer overflow.
+	Reported by Agostino Sarubbo.
+	Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2610
+
 2016-12-03 Even Rouault <even.rouault at spatialys.com>
 
 	* tools/tiffcp.c: avoid potential division by zero is BitsPerSamples tag is
 	missing.
 	Reported by Agostino Sarubbo.
diff --git a/tools/tiffcp.c b/tools/tiffcp.c
index 2d8dfba11..89b27f86d 100644
--- a/tools/tiffcp.c
+++ b/tools/tiffcp.c
@@ -1161,11 +1161,11 @@ bad:
 	return 0;
 }
 
 static void
 cpStripToTile(uint8* out, uint8* in,
-    uint32 rows, uint32 cols, int outskew, int inskew)
+    uint32 rows, uint32 cols, int outskew, int64 inskew)
 {
 	while (rows-- > 0) {
 		uint32 j = cols;
 		while (j-- > 0)
 			*out++ = *in++;
@@ -1318,11 +1318,11 @@ DECLAREreadFunc(readContigTilesIntoBuffer)
 	int status = 1;
 	tsize_t tilesize = TIFFTileSize(in);
 	tdata_t tilebuf;
 	uint32 imagew = TIFFScanlineSize(in);
 	uint32 tilew  = TIFFTileRowSize(in);
-	int iskew = imagew - tilew;
+	int64 iskew = (int64)imagew - (int64)tilew;
 	uint8* bufp = (uint8*) buf;
 	uint32 tw, tl;
 	uint32 row;
 
 	(void) spp;
@@ -1346,11 +1346,11 @@ DECLAREreadFunc(readContigTilesIntoBuffer)
 				    (unsigned long) col,
 				    (unsigned long) row);
 				status = 0;
 				goto done;
 			}
-			if (colb + tilew > imagew) {
+			if (colb > iskew) {
 				uint32 width = imagew - colb;
 				uint32 oskew = tilew - width;
 				cpStripToTile(bufp + colb,
 				    tilebuf, nrow, width,
 				    oskew + iskew, oskew );

Vulnerable code:     uint32 rows, uint32 cols, int outskew, int inskew)
	int iskew = imagew - tilew;
			if (colb + tilew > imagew) {
Fixed code: 2016-12-03 Even Rouault <even.rouault at spatialys.com>

	* tools/tiffcp.c: fix uint32 underflow/overflow that can cause heap-based
	buffer overflow.
	Reported by Agostino Sarubbo.
	Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2610

    uint32 rows, uint32 cols, int outskew, int64 inskew)
	int64 iskew = (int64)imagew - (int64)tilew;
			if (colb > iskew) {