8000 TIFF handling is broken with libtiff after CVE-2023-6277 fixes · Issue #900 · libgd/libgd · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content
TIFF handling is broken with libtiff after CVE-2023-6277 fixes #900
Open
@eds-collabora

Description

@eds-collabora

Describe the bug
TIFF files cannot be constructed from gd, and some tiff tests fail, e.g. tiff/tiff_dpi

To Reproduce
Steps to reproduce the behavior:
Build and run the tests against any version of libtiff with commit 5320c9d89c054fa805d037d84c57da874470b01a applied.

Expected behavior
Tests should pass

Actual results

+ exec libgd-gd-2.3.3/tests/tiff/.libs/tiff_dpi
TIFFWriteDirectorySec: Warning, Creating TIFF with legacy Deflate codec identifier, COMPRESSION_ADOBE_DEFLATE is more widely supported.
TIFFWriteDirectorySec: Warning, Creating TIFF with legacy Deflate codec identifier, COMPRESSION_ADOBE_DEFLATE is more widely supported.
TIFFFetchDirectory: Warning, Requested memory size for TIFF directory of 156 is greather than filesize 0. Memory not allocated, TIFF directory notread.
TIFFReadDirectory: Failed to read directory at offset 1208.
GD Warning: Cannot open TIFF imagetiff/tiff_dpi.c:56: could not create dst

Environment (please complete the following information):

  • OS: ArchLinux
  • Version 2.3.3-7
  • All libraries used by GD and their respective version (eg. Freetype 2.2.5)
    libtiff-4.6.0-4

Additional context
This is my understanding of the behaviour of the tiff_dpi test:

  • In gdImageCreateFromTiffCtx we receive an infile of type gdIOCtx *
  • This constructs a tiff_handle with new_tiff_handle, leaving the size stored in the handle at zero.
  • This is then handed as-is to TIFFClientOpen which refuses to read the image, because the reported file size is now 0, and the necessary file size for the contents it wants to map is nonzero.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

      0