CVE-2016-9538: Integer Overflow or Wraparound (CWE-190)
value: tools/tiffcrop.c in libtiff 4.0.6 reads an undefined buffer in readContigStripsIntoBuffer() because of a uint16 integer overflow. Reported as MSVR 35100.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2016-11-22T19:59Z
Repository: https://github.com/vadz/libtiff
Language: C
Files changed: ChangeLog, tools/tiffcp.c, tools/tiffcrop.c
Commit date: 2016-10-08 15:04:31 +0000
Commit message: * tools/tiffcp.c: fix read of undefined variable in case of missing
required tags. Found on test case of MSVR 35100.
* tools/tiffcrop.c: fix read of undefined buffer in
readContigStripsIntoBuffer() due to uint16 overflow. Probably not a
security issue but I can be wrong. Reported as MSVR 35100 by Axel
Souchet from the MSRC Vulnerabilities & Mitigations team.

Diff: diff --git a/ChangeLog b/ChangeLog
index c76f832c6..8f54f2860 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,14 @@
+2016-10-08 Even Rouault <even.rouault at spatialys.com>
+
+	* tools/tiffcp.c: fix read of undefined variable in case of missing
+	required tags. Found on test case of MSVR 35100.
+	* tools/tiffcrop.c: fix read of undefined buffer in
+	readContigStripsIntoBuffer() due to uint16 overflow. Probably not a
+	security issue but I can be wrong. Reported as MSVR 35100 by Axel
+	Souchet from the MSRC Vulnerabilities & Mitigations team.
+
 2016-09-25  Bob Friesenhahn  <bfriesen@simple.dallas.tx.us>
 
 	* html: Change as many remotesensing.org broken links to a working
 	URL as possible.
 
diff --git a/tools/tiffcp.c b/tools/tiffcp.c
index ba2b715c5..4ad74d391 100644
--- a/tools/tiffcp.c
+++ b/tools/tiffcp.c
@@ -590,12 +590,12 @@ static	copyFunc pickCopyFunc(TIFF*, TIFF*, uint16, uint16);
 /* PODD */
 
 static int
 tiffcp(TIFF* in, TIFF* out)
 {
-	uint16 bitspersample, samplesperpixel;
-	uint16 input_compression, input_photometric;
+	uint16 bitspersample, samplesperpixel = 1;
+	uint16 input_compression, input_photometric = PHOTOMETRIC_MINISBLACK;
 	copyFunc cf;
 	uint32 width, length;
 	struct cpTag* p;
 
 	CopyField(TIFFTAG_IMAGEWIDTH, width);
diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
index 76855665a..eb6de77cb 100644
--- a/tools/tiffcrop.c
+++ b/tools/tiffcrop.c
@@ -3626,11 +3626,11 @@ extractContigSamplesToTileBuffer(uint8 *out, uint8 *in, uint32 rows, uint32 cols
 
 static int readContigStripsIntoBuffer (TIFF* in, uint8* buf)
 {
         uint8* bufp = buf;
         int32  bytes_read = 0;
-        uint16 strip, nstrips   = TIFFNumberOfStrips(in);
+        uint32 strip, nstrips   = TIFFNumberOfStrips(in);
         uint32 stripsize = TIFFStripSize(in);
         uint32 rows = 0;
         uint32 rps = TIFFGetFieldDefaulted(in, TIFFTAG_ROWSPERSTRIP, &rps);
         tsize_t scanline_size = TIFFScanlineSize(in);
 
@@ -4709,13 +4709,16 @@ combineSeparateTileSamples32bits (uint8 *in[], uint8 *out, uint32 cols,
 
 static int readSeparateStripsIntoBuffer (TIFF *in, uint8 *obuf, uint32 length, 
                                          uint32 width, uint16 spp,
                                          struct dump_opts *dump)
   {
-  int i, j, bytes_per_sample, bytes_per_pixel, shift_width, result = 1;
+  int i, bytes_per_sample, bytes_per_pixel, shift_width, result = 1;
+  uint32 j;
   int32  bytes_read = 0;
-  uint16 bps, nstrips, planar, strips_per_sample;
+  uint16 bps, planar;
+  uint32 nstrips;
+  uint32 strips_per_sample;
   uint32 src_rowsize, dst_rowsize, rows_processed, rps;
   uint32 rows_this_strip = 0;
   tsample_t s;
   tstrip_t  strip;
   tsize_t scanlinesize = TIFFScanlineSize(in);

Vulnerable code: 	uint16 bitspersample, samplesperpixel;
	uint16 input_compression, input_photometric;
        uint16 strip, nstrips   = TIFFNumberOfStrips(in);
  int i, j, bytes_per_sample, bytes_per_pixel, shift_width, result = 1;
  uint16 bps, nstrips, planar, strips_per_sample;
Fixed code: 2016-10-08 Even Rouault <even.rouault at spatialys.com>

	* tools/tiffcp.c: fix read of undefined variable in case of missing
	required tags. Found on test case of MSVR 35100.
	* tools/tiffcrop.c: fix read of undefined buffer in
	readContigStripsIntoBuffer() due to uint16 overflow. Probably not a
	security issue but I can be wrong. Reported as MSVR 35100 by Axel
	Souchet from the MSRC Vulnerabilities & Mitigations team.

	uint16 bitspersample, samplesperpixel = 1;
	uint16 input_compression, input_photometric = PHOTOMETRIC_MINISBLACK;
        uint32 strip, nstrips   = TIFFNumberOfStrips(in);
  int i, bytes_per_sample, bytes_per_pixel, shift_width, result = 1;
  uint32 j;
  uint16 bps, planar;
  uint32 nstrips;
  uint32 strips_per_sample;