oss-security - DoS in libtiff

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACn5sdSySyCbjCxTqsVzO8o5CVebYf3YixbwR5rR0XB1i5pT8g@mail.gmail.com>
Date: Mon, 21 Sep 2015 12:02:10 -0300
From: Gustavo Grieco <gustavo.grieco@...il.com>
To: oss-security@...ts.openwall.com
Subject: DoS in libtiff

Hi,

We found a DoS using a crafted tiff file that causes a OOM kill in low memory
system (usually less than 3GB). This was tested in Ubuntu 14.04 (64bit) but the
issue exists even in the CVS libtiff version. Please find attached the
compressed test case (otherwise it can kill my browser since gdk-pixbuf is
loading tiff files in the preview dialog!). You can test it executing:

$ tiffdither oom.tif /dev/null

If you run it with ltrace, you can see some very large reallocs:

libtiff.so.5->realloc(0, 1636178024)
             = 0x7f71a42b6010
libtiff.so.5->realloc(0, 1636178024)
             = 0x7f7142a54010

Upstream was notified but there is still no fix.

Regards,

Gustavo.

Content of type "text/html" skipped

Download attachment "oom.tif.gz" of type "application/x-gzip" (98 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.