2009.05.19 12:32 "[Tiff] Heap corruption caused by TIFFRGBAImageGet() + TIFFSetDirectory() + TIFFRewriteDirectory()", by

TIFFStartStrip() uses the raw buffer for *reading* data and sets tif_rawcc to a positive value:

     tif->tif_rawcc = td->td_stripbytecount[strip];

TIFFReadDirectory() resets tif_curstrip to -1, but doesn't reset tif_rawcc to 0:

     tif->tif_curstrip = (tstrip_t) -1;

In consequence, the next call to _TIFFWriteDirectory() thinks there is pending data to *write*:

         if (tif->tif_rawcc > 0 && !TIFFFlushData1(tif)) {

and TIFFAppendToStrip() will modify td_stripoffset[-1] (as strip = tif->tif_curstrip = (tstrip_t)-1):

                                     td->td_stripoffset[strip] =
                                             TIFFSeekFile(tif, (toff_t)0,
                                                          SEEK_END);

Probably ditto for tiled images. There seems to be no way to reset tif_rawcc to 0 with the official

API except for reopening the image.

When built with dmalloc, the program below will result in this output:

libtiff version: LIBTIFF, Version 3.8.2
Copyright (c) 1988-1996 Sam Leffler
Copyright (c) 1991-1996 Silicon Graphics, Inc.
tif_rawcc=115
tif_curtile=-1
tif_curstrip=2338

tif_rawcc=115
tif_curtile=-1
tif_curstrip=-1

debug-malloc library: dumping program, fatal error
   Error: failed UNDER picket-fence magic-number check (err 26)
Aborted

Here's the program:

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include "tiffio.h"
#ifdef HAVE_TIFFIOP_H
#include "tiffiop.h"
#endif

static void show (TIFF *tif)
{
#ifdef HAVE_TIFFIOP_H
   printf ("tif_rawcc=%ld\n", (long)tif->tif_rawcc);
   printf ("tif_curtile=%ld\n", (long)tif->tif_curtile);
   printf ("tif_curstrip=%ld\n", (long)tif->tif_curstrip);
   printf ("\n");
#endif
}

int main (int argc, char *argv[])
{
   const char *path;
   TIFF *tif;
   uint32 width, height;
   TIFFRGBAImage img;
   size_t size;
   uint32 *raster;
   char msg[1024];

printf ("libtiff version: %s\n", TIFFGetVersion ());
if (argc != 2)
  {
    fprintf (stderr, "Usage: %s TIFF_FILE\n", argv[0]);
    exit (1);
  }
path = argv[1];
tif = TIFFOpen (path, "r+");
if (tif == NULL)
  {
    perror (path);
    exit (2);
  }

if (TIFFRGBAImageOK (tif, msg) != 1)
  {
    fprintf (stderr, "Cannot process image as RGBA (%s)\n", msg);
    exit (2);
  }
if (TIFFRGBAImageBegin (&img, tif, 1, msg) != 1)
  {
    fprintf (stderr, "TIFFRGBAImageBegin failed (%s)\n", msg);
    exit (2);
  }
TIFFGetField (tif, TIFFTAG_IMAGEWIDTH, &width);
TIFFGetField (tif, TIFFTAG_IMAGELENGTH, &height);
size = (size_t)-1;
if (width > size / height / sizeof (uint32))
  {
    fprintf (stderr, "Image too big\n");
    exit (2);
  }
size = width * height * sizeof (uint32);
raster = (uint32 *)malloc (size);
if (raster == NULL)
  {
    fprintf (stderr, "Out of memory\n");
    exit (2);
  }
if (TIFFRGBAImageGet (&img, raster, width, height) != 1)
  {
    fprintf (stderr, "TIFFRGBAImageGet failed\n");
    exit (2);
  }
TIFFRGBAImageEnd (&img);

show (tif);

if (TIFFSetDirectory (tif, 0) != 1)
  {
    fprintf (stderr, "TIFFSetDirectory failed\n");
    exit (2);
  }

show (tif);

/*... set some fields here... */

if (TIFFRewriteDirectory (tif) != 1)
  {
    fprintf (stderr, "TIFFRewriteDirectory failed\n");
    exit (2);
  }

   TIFFClose (tif);
   return 0;
}