oss-sec mailing list archives
libtiff: memory allocation failure in _TIFFCheckRealloc (tif_aux.c)
From: Agostino Sarubbo <ago () gentoo org>
Date: Wed, 09 Nov 2016 15:47:11 +0100
If it is suitable for a CVE please assign one. Thanks.
Description:
libtiff is a software that provides support for the Tag Image File Format
(TIFF).
During the fuzz of imagemagick, I noticed a memory allocation failure in
libtiff. The issue was first reported to the imagemagick’s developers which
confirmed that the issue resides in libtiff instead of imagemagick.
The complete ASan output:
# identify $FILE
==26726==ERROR: AddressSanitizer failed to allocate 0x4195c4000 (17605345280)
bytes of LargeMmapAllocator (error code: 12)
==26726==Process memory map follows:
0x000000400000-0x000000520000 /usr/bin/magick
0x000000720000-0x000000721000 /usr/bin/magick
0x000000721000-0x000000724000 /usr/bin/magick
0x000000724000-0x000001397000
0x00007fff7000-0x00008fff7000
0x00008fff7000-0x02008fff7000
0x02008fff7000-0x10007fff8000
0x600000000000-0x602000000000
0x602000000000-0x602000010000
0x602000010000-0x603000000000
0x603000000000-0x603000010000
0x603000010000-0x604000000000
0x604000000000-0x604000020000
0x604000020000-0x606000000000
0x606000000000-0x606000020000
0x606000020000-0x607000000000
0x607000000000-0x607000010000
0x607000010000-0x608000000000
0x608000000000-0x608000010000
0x608000010000-0x60a000000000
0x60a000000000-0x60a000020000
0x60a000020000-0x60b000000000
0x60b000000000-0x60b000010000
0x60b000010000-0x60c000000000
0x60c000000000-0x60c000010000
0x60c000010000-0x60d000000000
0x60d000000000-0x60d000010000
0x60d000010000-0x60e000000000
0x60e000000000-0x60e000010000
0x60e000010000-0x60f000000000
0x60f000000000-0x60f000010000
0x60f000010000-0x610000000000
0x610000000000-0x610000010000
0x610000010000-0x611000000000
0x611000000000-0x611000010000
0x611000010000-0x612000000000
0x612000000000-0x612000010000
0x612000010000-0x613000000000
0x613000000000-0x613000010000
0x613000010000-0x614000000000
0x614000000000-0x614000020000
0x614000020000-0x615000000000
0x615000000000-0x615000020000
0x615000020000-0x616000000000
0x616000000000-0x616000020000
0x616000020000-0x618000000000
0x618000000000-0x618000020000
0x618000020000-0x619000000000
0x619000000000-0x619000020000
0x619000020000-0x61a000000000
0x61a000000000-0x61a000020000
0x61a000020000-0x61b000000000
0x61b000000000-0x61b000020000
0x61b000020000-0x61d000000000
0x61d000000000-0x61d000020000
0x61d000020000-0x621000000000
0x621000000000-0x621000020000
0x621000020000-0x622000000000
0x622000000000-0x622000020000
0x622000020000-0x623000000000
0x623000000000-0x623000020000
0x623000020000-0x624000000000
0x624000000000-0x624000020000
0x624000020000-0x625000000000
0x625000000000-0x625000020000
0x625000020000-0x627000000000
0x627000000000-0x627000030000
0x627000030000-0x629000000000
0x629000000000-0x629000010000
0x629000010000-0x62f000000000
0x62f000000000-0x62f000030000
0x62f000030000-0x640000000000
0x640000000000-0x640000003000
0x7fa3c74b3000-0x7fa3c7517000 /usr/lib64/libtiff.so.5.2.4
0x7fa3c7517000-0x7fa3c7717000 /usr/lib64/libtiff.so.5.2.4
0x7fa3c7717000-0x7fa3c7718000 /usr/lib64/libtiff.so.5.2.4
0x7fa3c7718000-0x7fa3c771b000 /usr/lib64/libtiff.so.5.2.4
0x7fa3c771b000-0x7fa3c771c000
0x7fa3c771c000-0x7fa3c7786000 /usr/lib64/ImageMagick-7.0.3/modules-
Q64HDRI/coders/tiff.so
0x7fa3c7786000-0x7fa3c7986000 /usr/lib64/ImageMagick-7.0.3/modules-
Q64HDRI/coders/tiff.so
0x7fa3c7986000-0x7fa3c7988000 /usr/lib64/ImageMagick-7.0.3/modules-
Q64HDRI/coders/tiff.so
0x7fa3c7988000-0x7fa3c798e000 /usr/lib64/ImageMagick-7.0.3/modules-
Q64HDRI/coders/tiff.so
0x7fa3c798e000-0x7fa3ce000000 /usr/lib64/locale/locale-archive
0x7fa3ce000000-0x7fa3ce100000
0x7fa3ce200000-0x7fa3ce300000
0x7fa3ce31d000-0x7fa3d066f000
0x7fa3d066f000-0x7fa3d0696000 /usr/lib64/libexpat.so.1.6.0
0x7fa3d0696000-0x7fa3d0895000 /usr/lib64/libexpat.so.1.6.0
0x7fa3d0895000-0x7fa3d0898000 /usr/lib64/libexpat.so.1.6.0
0x7fa3d0898000-0x7fa3d0899000 /usr/lib64/libexpat.so.1.6.0
0x7fa3d0899000-0x7fa3d09ce000 /usr/lib64/libglib-2.0.so.0.4600.2
0x7fa3d09ce000-0x7fa3d0bce000 /usr/lib64/libglib-2.0.so.0.4600.2
0x7fa3d0bce000-0x7fa3d0bcf000 /usr/lib64/libglib-2.0.so.0.4600.2
0x7fa3d0bcf000-0x7fa3d0bd0000 /usr/lib64/libglib-2.0.so.0.4600.2
0x7fa3d0bd0000-0x7fa3d0bd1000
0x7fa3d0bd1000-0x7fa3d0bda000 /usr/lib64/libltdl.so.7.3.1
0x7fa3d0bda000-0x7fa3d0dd9000 /usr/lib64/libltdl.so.7.3.1
0x7fa3d0dd9000-0x7fa3d0dda000 /usr/lib64/libltdl.so.7.3.1
0x7fa3d0dda000-0x7fa3d0ddb000 /usr/lib64/libltdl.so.7.3.1
0x7fa3d0ddb000-0x7fa3d0df0000 /lib64/libz.so.1.2.8
0x7fa3d0df0000-0x7fa3d0fef000 /lib64/libz.so.1.2.8
0x7fa3d0fef000-0x7fa3d0ff0000 /lib64/libz.so.1.2.8
0x7fa3d0ff0000-0x7fa3d0ff1000 /lib64/libz.so.1.2.8
0x7fa3d0ff1000-0x7fa3d1000000 /lib64/libbz2.so.1.0.6
0x7fa3d1000000-0x7fa3d11ff000 /lib64/libbz2.so.1.0.6
0x7fa3d11ff000-0x7fa3d1200000 /lib64/libbz2.so.1.0.6
0x7fa3d1200000-0x7fa3d1201000 /lib64/libbz2.so.1.0.6
0x7fa3d1201000-0x7fa3d12a8000 /usr/lib64/libfreetype.so.6.12.3
0x7fa3d12a8000-0x7fa3d14a8000 /usr/lib64/libfreetype.so.6.12.3
0x7fa3d14a8000-0x7fa3d14ae000 /usr/lib64/libfreetype.so.6.12.3
0x7fa3d14ae000-0x7fa3d14af000 /usr/lib64/libfreetype.so.6.12.3
0x7fa3d14af000-0x7fa3d14ea000 /usr/lib64/libfontconfig.so.1.8.0
0x7fa3d14ea000-0x7fa3d16e9000 /usr/lib64/libfontconfig.so.1.8.0
0x7fa3d16e9000-0x7fa3d16eb000 /usr/lib64/libfontconfig.so.1.8.0
0x7fa3d16eb000-0x7fa3d16ec000 /usr/lib64/libfontconfig.so.1.8.0
0x7fa3d16ec000-0x7fa3d18e1000 /usr/lib64/libfftw3.so.3.4.4
0x7fa3d18e1000-0x7fa3d1ae0000 /usr/lib64/libfftw3.so.3.4.4
0x7fa3d1ae0000-0x7fa3d1af4000 /usr/lib64/libfftw3.so.3.4.4
0x7fa3d1af4000-0x7fa3d1af5000 /usr/lib64/libfftw3.so.3.4.4
0x7fa3d1af5000-0x7fa3d1b03000 /usr/lib64/liblqr-1.so.0.3.2
0x7fa3d1b03000-0x7fa3d1d02000 /usr/lib64/liblqr-1.so.0.3.2
0x7fa3d1d02000-0x7fa3d1d03000 /usr/lib64/liblqr-1.so.0.3.2
0x7fa3d1d03000-0x7fa3d1d04000 /usr/lib64/liblqr-1.so.0.3.2
0x7fa3d1d04000-0x7fa3d1d57000 /usr/lib64/liblcms2.so.2.0.6
0x7fa3d1d57000-0x7fa3d1f57000 /usr/lib64/liblcms2.so.2.0.6
0x7fa3d1f57000-0x7fa3d1f58000 /usr/lib64/liblcms2.so.2.0.6
0x7fa3d1f58000-0x7fa3d1f5d000 /usr/lib64/liblcms2.so.2.0.6
0x7fa3d1f5d000-0x7fa3d20f0000 /lib64/libc-2.22.so
0x7fa3d20f0000-0x7fa3d22f0000 /lib64/libc-2.22.so
0x7fa3d22f0000-0x7fa3d22f4000 /lib64/libc-2.22.so
0x7fa3d22f4000-0x7fa3d22f6000 /lib64/libc-2.22.so
0x7fa3d22f6000-0x7fa3d22fa000
0x7fa3d22fa000-0x7fa3d2310000 /usr/lib64/gcc/x86_64-pc-linux-
gnu/4.9.3/libgcc_s.so.1
0x7fa3d2310000-0x7fa3d250f000 /usr/lib64/gcc/x86_64-pc-linux-
gnu/4.9.3/libgcc_s.so.1
0x7fa3d250f000-0x7fa3d2510000 /usr/lib64/gcc/x86_64-pc-linux-
gnu/4.9.3/libgcc_s.so.1
0x7fa3d2510000-0x7fa3d2511000 /usr/lib64/gcc/x86_64-pc-linux-
gnu/4.9.3/libgcc_s.so.1
0x7fa3d2511000-0x7fa3d2517000 /lib64/librt-2.22.so
0x7fa3d2517000-0x7fa3d2717000 /lib64/librt-2.22.so
0x7fa3d2717000-0x7fa3d2718000 /lib64/librt-2.22.so
0x7fa3d2718000-0x7fa3d2719000 /lib64/librt-2.22.so
0x7fa3d2719000-0x7fa3d2730000 /lib64/libpthread-2.22.so
0x7fa3d2730000-0x7fa3d292f000 /lib64/libpthread-2.22.so
0x7fa3d292f000-0x7fa3d2930000 /lib64/libpthread-2.22.so
0x7fa3d2930000-0x7fa3d2931000 /lib64/libpthread-2.22.so
0x7fa3d2931000-0x7fa3d2935000
0x7fa3d2935000-0x7fa3d2a32000 /lib64/libm-2.22.so
0x7fa3d2a32000-0x7fa3d2c31000 /lib64/libm-2.22.so
0x7fa3d2c31000-0x7fa3d2c32000 /lib64/libm-2.22.so
0x7fa3d2c32000-0x7fa3d2c33000 /lib64/libm-2.22.so
0x7fa3d2c33000-0x7fa3d2c35000 /lib64/libdl-2.22.so
0x7fa3d2c35000-0x7fa3d2e35000 /lib64/libdl-2.22.so
0x7fa3d2e35000-0x7fa3d2e36000 /lib64/libdl-2.22.so
0x7fa3d2e36000-0x7fa3d2e37000 /lib64/libdl-2.22.so
0x7fa3d2e37000-0x7fa3d32fd000
/usr/lib64/libMagickWand-7.Q64HDRI.so.0.0.0
0x7fa3d32fd000-0x7fa3d34fc000
/usr/lib64/libMagickWand-7.Q64HDRI.so.0.0.0
0x7fa3d34fc000-0x7fa3d3511000
/usr/lib64/libMagickWand-7.Q64HDRI.so.0.0.0
0x7fa3d3511000-0x7fa3d3553000
/usr/lib64/libMagickWand-7.Q64HDRI.so.0.0.0
0x7fa3d3553000-0x7fa3d40e6000
/usr/lib64/libMagickCore-7.Q64HDRI.so.0.0.0
0x7fa3d40e6000-0x7fa3d42e5000
/usr/lib64/libMagickCore-7.Q64HDRI.so.0.0.0
0x7fa3d42e5000-0x7fa3d431e000
/usr/lib64/libMagickCore-7.Q64HDRI.so.0.0.0
0x7fa3d431e000-0x7fa3d4390000
/usr/lib64/libMagickCore-7.Q64HDRI.so.0.0.0
0x7fa3d4390000-0x7fa3d4393000
0x7fa3d4393000-0x7fa3d43b5000 /lib64/ld-2.22.so
0x7fa3d44ad000-0x7fa3d44cd000
0x7fa3d44cd000-0x7fa3d44f0000
/usr/share/locale/it/LC_MESSAGES/libc.mo
0x7fa3d44f0000-0x7fa3d44f1000
0x7fa3d44f5000-0x7fa3d45a7000
0x7fa3d45a7000-0x7fa3d45b4000
0x7fa3d45b4000-0x7fa3d45b5000 /lib64/ld-2.22.so
0x7fa3d45b5000-0x7fa3d45b6000 /lib64/ld-2.22.so
0x7fa3d45b6000-0x7fa3d45b7000
0x7fff923b9000-0x7fff923da000 [stack]
0x7fff923de000-0x7fff923e0000 [vvar]
0x7fff923e0000-0x7fff923e2000 [vdso]
0xffffffffff600000-0xffffffffff601000 [vsyscall]
==26726==End of process memory map.
==26726==AddressSanitizer CHECK failed: /var/tmp/portage/sys-devel/llvm-3.8.1-
r2/work/llvm-3.8.1.src/projects/compiler-
rt/lib/sanitizer_common/sanitizer_common.cc:183 "((0 && "unable to mmap")) !=
(0)" (0x0, 0x0)
#0 0x4c9f9d in AsanCheckFailed /var/tmp/portage/sys-devel/llvm-3.8.1-
r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/asan/asan_rtl.cc:67
#1 0x4d0ad3 in __sanitizer::CheckFailed(char const*, int, char const*,
unsigned long long, unsigned long long) /var/tmp/portage/sys-devel/llvm-3.8.1-
r2/work/llvm-3.8.1.src/projects/compiler-
rt/lib/sanitizer_common/sanitizer_common.cc:159
#2 0x4d0cc1 in __sanitizer::ReportMmapFailureAndDie(unsigned long, char
const*, char const*, int, bool) /var/tmp/portage/sys-devel/llvm-3.8.1-
r2/work/llvm-3.8.1.src/projects/compiler-
rt/lib/sanitizer_common/sanitizer_common.cc:183
#3 0x4d9cfa in __sanitizer::MmapOrDie(unsigned long, char const*, bool)
/var/tmp/portage/sys-devel/llvm-3.8.1-
r2/work/llvm-3.8.1.src/projects/compiler-
rt/lib/sanitizer_common/sanitizer_posix.cc:122
#4 0x4244ea in
__sanitizer::LargeMmapAllocator::Allocate(__sanitizer::AllocatorStats*,
unsigned long, unsigned long) /var/tmp/portage/sys-devel/llvm-3.8.1-
r2/work/llvm-3.8.1.src/projects/compiler-
rt/lib/asan/../sanitizer_common/sanitizer_allocator.h:1033
#5 0x4244ea in
__sanitizer::CombinedAllocator<__sanitizer::SizeClassAllocator64<105553116266496ul,
4398046511104ul, 0ul, __sanitizer::SizeClassMap,
__asan::AsanMapUnmapCallback>,
__sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64<105553116266496ul,
4398046511104ul, 0ul, __sanitizer::SizeClassMap, __asan::AsanMapUnmapCallback>
, __sanitizer::LargeMmapAllocator ::Allocate(__sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64<105553116266496ul,
4398046511104ul, 0ul, __sanitizer::SizeClassMap, __asan::AsanMapUnmapCallback>
*, unsigned long, unsigned long, bool, bool) /var/tmp/portage/sys-
devel/llvm-3.8.1-r2/work/llvm-3.8.1.src/projects/compiler-
rt/lib/asan/../sanitizer_common/sanitizer_allocator.h:1302
#6 0x4244ea in __asan::Allocator::Allocate(unsigned long, unsigned long,
__sanitizer::BufferedStackTrace*, __asan::AllocType, bool)
/var/tmp/portage/sys-devel/llvm-3.8.1-
r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/asan/asan_allocator.cc:368
#7 0x4c09e1 in realloc /var/tmp/portage/sys-devel/llvm-3.8.1-
r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:79
#8 0x7fa3c74badcb in _TIFFCheckRealloc /tmp/portage/media-
libs/tiff-4.0.6/work/tiff-4.0.6/libtiff/tif_aux.c:73
#9 0x7fa3c74c8599 in ChopUpSingleUncompressedStrip /tmp/portage/media-
libs/tiff-4.0.6/work/tiff-4.0.6/libtiff/tif_dirread.c:5519
#10 0x7fa3c74c8599 in TIFFReadDirectory /tmp/portage/media-
libs/tiff-4.0.6/work/tiff-4.0.6/libtiff/tif_dirread.c:4032
#11 0x7fa3c74e1d21 in TIFFClientOpen /tmp/portage/media-
libs/tiff-4.0.6/work/tiff-4.0.6/libtiff/tif_open.c:466
#12 0x7fa3c7731955 in ReadTIFFImage /tmp/portage/media-
gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/coders/tiff.c:1160:8
#13 0x7fa3d37beb12 in ReadImage /tmp/portage/media-
gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickCore/constitute.c:496:13
#14 0x7fa3d3f56406 in ReadStream /tmp/portage/media-
gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickCore/stream.c:1012:9
#15 0x7fa3d37bd5ca in PingImage /tmp/portage/media-
gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickCore/constitute.c:226:9
#16 0x7fa3d37bde25 in PingImages /tmp/portage/media-
gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickCore/constitute.c:326:10
#17 0x7fa3d30434c3 in IdentifyImageCommand /tmp/portage/media-
gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickWand/identify.c:319:18
#18 0x7fa3d30d926a in MagickCommandGenesis /tmp/portage/media-
gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickWand/mogrify.c:183:14
#19 0x4f1fb5 in MagickMain /tmp/portage/media-
gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/utilities/magick.c:145:10
#20 0x4f1fb5 in main /tmp/portage/media-
gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/utilities/magick.c:176
#21 0x7fa3d1f7d61f in __libc_start_main /var/tmp/portage/sys-
libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289
#22 0x419138 in _init (/usr/bin/magick+0x419138)
Affected version:
4.0.6
Fixed version:
N/A
Commit fix:
N/A
Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.
CVE:
N/A
Reproducer:
https://github.com/asarubbo/poc/blob/master/00032-libtiff-memalloc-_TIFFCheckRealloc
Timeline:
2016-09-14: bug discovered
2016-11-04: bug reported to upstream
2016-11-09: blog post about the issue
Note:
This bug was found with American Fuzzy Lop.
Permalink:
https://blogs.gentoo.org/ago/2016/11/09/libtiff-memory-allocation-failure-in-_tiffcheckrealloc-tif_aux-c
Current thread:
- libtiff: memory allocation failure in _TIFFCheckRealloc (tif_aux.c) Agostino Sarubbo (Nov 09)