CVE-2016-10093: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Integer overflow in tools/tiffcp.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5 and 4.0.6 allows remote attackers to have unspecified impact via a crafted image, which triggers a heap-based buffer overflow.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2017-03-01T15:59Z
Repository: https://github.com/vadz/libtiff
Language: Other
Files changed: ChangeLog, tools/tiffcp.c
Commit date: 2016-12-03 16:40:01 +0000
Commit message: * tools/tiffcp.c: fix uint32 underflow/overflow that can cause heap-based
buffer overflow.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2610

Diff: diff --git a/ChangeLog b/ChangeLog
index 94be03859..8ee76c0ad 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
+2016-12-03 Even Rouault <even.rouault at spatialys.com>
+
+	* tools/tiffcp.c: fix uint32 underflow/overflow that can cause heap-based
+	buffer overflow.
+	Reported by Agostino Sarubbo.
+	Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2610
+
 2016-12-03 Even Rouault <even.rouault at spatialys.com>
 
 	* tools/tiffcp.c: avoid potential division by zero is BitsPerSamples tag is
 	missing.
 	Reported by Agostino Sarubbo.
diff --git a/tools/tiffcp.c b/tools/tiffcp.c
index 2d8dfba11..89b27f86d 100644
--- a/tools/tiffcp.c
+++ b/tools/tiffcp.c
@@ -1161,11 +1161,11 @@ bad:
 	return 0;
 }
 
 static void
 cpStripToTile(uint8* out, uint8* in,
-    uint32 rows, uint32 cols, int outskew, int inskew)
+    uint32 rows, uint32 cols, int outskew, int64 inskew)
 {
 	while (rows-- > 0) {
 		uint32 j = cols;
 		while (j-- > 0)
 			*out++ = *in++;
@@ -1318,11 +1318,11 @@ DECLAREreadFunc(readContigTilesIntoBuffer)
 	int status = 1;
 	tsize_t tilesize = TIFFTileSize(in);
 	tdata_t tilebuf;
 	uint32 imagew = TIFFScanlineSize(in);
 	uint32 tilew  = TIFFTileRowSize(in);
-	int iskew = imagew - tilew;
+	int64 iskew = (int64)imagew - (int64)tilew;
 	uint8* bufp = (uint8*) buf;
 	uint32 tw, tl;
 	uint32 row;
 
 	(void) spp;
@@ -1346,11 +1346,11 @@ DECLAREreadFunc(readContigTilesIntoBuffer)
 				    (unsigned long) col,
 				    (unsigned long) row);
 				status = 0;
 				goto done;
 			}
-			if (colb + tilew > imagew) {
+			if (colb > iskew) {
 				uint32 width = imagew - colb;
 				uint32 oskew = tilew - width;
 				cpStripToTile(bufp + colb,
 				    tilebuf, nrow, width,
 				    oskew + iskew, oskew );

Vulnerable code:     uint32 rows, uint32 cols, int outskew, int inskew)
	int iskew = imagew - tilew;
			if (colb + tilew > imagew) {
Fixed code: 2016-12-03 Even Rouault <even.rouault at spatialys.com>

	* tools/tiffcp.c: fix uint32 underflow/overflow that can cause heap-based
	buffer overflow.
	Reported by Agostino Sarubbo.
	Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2610

    uint32 rows, uint32 cols, int outskew, int64 inskew)
	int64 iskew = (int64)imagew - (int64)tilew;
			if (colb > iskew) {