CVE-2016-10270 (C, published 2017-03-24T19:59Z)
Description: value: LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 8" and libtiff/tif_read.c:523:22.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/vadz/libtiff
Files changed:
ChangeLog
libtiff/tif_dirread.c
libtiff/tif_strip.c
Commit message: * libtiff/tif_dirread.c: modify ChopUpSingleUncompressedStrip() to
instanciate compute ntrips as TIFFhowmany_32(td->td_imagelength, rowsperstrip),
instead of a logic based on the total size of data. Which is faulty is
the total size of data is not sufficient to fill the whole image, and thus
results in reading outside of the StripByCounts/StripOffsets arrays when
using TIFFReadScanline().
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2608.

* libtiff/tif_strip.c: revert the change in TIFFNumberOfStrips() done
for http://bugzilla.maptools.org/show_bug.cgi?id=2587 / CVE-2016-9273 since
the above change is a better fix that makes it unnecessary.


Vulnerable code:
	uint64 nstrips64;
	uint32 nstrips32;
	 * never increase the number of strips in an image
	nstrips64 = TIFFhowmany_64(bytecount, stripbytes);
	if ((nstrips64==0)||(nstrips64>0xFFFFFFFF)) /* something is wonky, do nothing. */
	    return;
	nstrips32 = (uint32)nstrips64;
	newcounts = (uint64*) _TIFFCheckMalloc(tif, nstrips32, sizeof (uint64),
	newoffsets = (uint64*) _TIFFCheckMalloc(tif, nstrips32, sizeof (uint64),
	for (strip = 0; strip < nstrips32; strip++) {
		newoffsets[strip] = offset;
	td->td_stripsperimage = td->td_nstrips = nstrips32;
    /* If the value was already computed and store in td_nstrips, then return it,
       since ChopUpSingleUncompressedStrip might have altered and resized the
       since the td_stripbytecount and td_stripoffset arrays to the new value
       after the initial affectation of td_nstrips = TIFFNumberOfStrips() in
       tif_dirread.c ~line 3612.
       See http://bugzilla.maptools.org/show_bug.cgi?id=2587 */
    if( td->td_nstrips )
        return td->td_nstrips;


Fixed code:
2016-12-03 Even Rouault <even.rouault at spatialys.com>

	* libtiff/tif_dirread.c: modify ChopUpSingleUncompressedStrip() to
	instanciate compute ntrips as TIFFhowmany_32(td->td_imagelength, rowsperstrip),
	instead of a logic based on the total size of data. Which is faulty is
	the total size of data is not sufficient to fill the whole image, and thus
	results in reading outside of the StripByCounts/StripOffsets arrays when
	using TIFFReadScanline().
	Reported by Agostino Sarubbo.
	Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2608.

	* libtiff/tif_strip.c: revert the change in TIFFNumberOfStrips() done
	for http://bugzilla.maptools.org/show_bug.cgi?id=2587 / CVE-2016-9273 since
	the above change is a better fix that makes it unnecessary.

	uint32 nstrips;
	 * never increase the number of rows per strip
        nstrips = TIFFhowmany_32(td->td_imagelength, rowsperstrip);
        if( nstrips == 0 )
            return;
	newcounts = (uint64*) _TIFFCheckMalloc(tif, nstrips, sizeof (uint64),
	newoffsets = (uint64*) _TIFFCheckMalloc(tif, nstrips, sizeof (uint64),
	for (strip = 0; strip < nstrips; strip++) {
		newoffsets[strip] = stripbytes ? offset : 0;
	td->td_stripsperimage = td->td_nstrips = nstrips;