#309 Heap buffer overflow in FreeImageTag.cpp:274

[freeKim]

Heap buffer overflow in FreeImageTag.cpp:274

Summary:

There is a heap buffer overflow in FreeImageTag.cpp(line 274) while loading image with FreeImage_Load function。

Version Affected: 3.19.0 (r1828)

ASAN Details

==44698==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000152 at pc 0x56519dfd5d9d bp 0x7ffed5d3c400 sp 0x7ffed5d3c3f0
READ of size 1 at 0x602000000152 thread T0
    #0 0x56519dfd5d9c in FreeImage_SetTagValue Source/Metadata/FreeImageTag.cpp:274
    #1 0x56519dfead7e in tiff_read_exif_tag Source/Metadata/XTIFF.cpp:532
    #2 0x56519dfed623 in tiff_read_exif_tags(tiff*, TagLib::MDMODEL, FIBITMAP*) Source/Metadata/XTIFF.cpp:570
    #3 0x56519df2b71b in tiff_read_exif_profile Source/FreeImage/PluginTIFF.cpp:826
    #4 0x56519df2b71b in ReadMetadata Source/FreeImage/PluginTIFF.cpp:863
    #5 0x56519df2b71b in Load Source/FreeImage/PluginTIFF.cpp:2295
    #6 0x56519de2247b in FreeImage_LoadFromHandle Source/FreeImage/Plugin.cpp:388
    #7 0x56519de2247b in FreeImage_LoadFromHandle Source/FreeImage/Plugin.cpp:380
    #8 0x56519de22952 in FreeImage_Load Source/FreeImage/Plugin.cpp:408
    #9 0x56519dddd12b in main /home/lab4/src/freeimage-svn/FreeImage/trunk/load-test.c:16
    #10 0x7f5435989b6a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x26b6a)
    #11 0x56519ddedf69 in _start (/home/lab4/src/freeimage-svn/FreeImage/trunk/load-test+0x149f69)

0x602000000152 is located 0 bytes to the right of 2-byte region [0x602000000150,0x602000000152)
allocated by thread T0 here:
    #0 0x7f5435fa4448 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10c448)
    #1 0x56519e22c6a4 in setByteArray Source/LibTIFF4/tif_dir.c:51
    #2 0x56519e22c6a4 in setByteArray Source/LibTIFF4/tif_dir.c:42
    #3 0x56519e22c6a4 in _TIFFVSetField Source/LibTIFF4/tif_dir.c:587
    #4 0x56519e231d29 in TIFFVSetField Source/LibTIFF4/tif_dir.c:868
    #5 0x56519e231d29 in TIFFVSetField Source/LibTIFF4/tif_dir.c:865
    #6 0x56519e231d29 in TIFFSetField Source/LibTIFF4/tif_dir.c:812
    #7 0x56519e2605e8 in TIFFFetchNormalTag Source/LibTIFF4/tif_dirread.c:5029
    #8 0x56519e2800e5 in TIFFReadDirectory Source/LibTIFF4/tif_dirread.c:3993
    #9 0x56519e2faaee in TIFFClientOpen Source/LibTIFF4/tif_open.c:482
    #10 0x56519df23a76 in TIFFFdOpen(void*, char const*, char const*) Source/FreeImage/PluginTIFF.cpp:193
    #11 0x56519df23a76 in Open Source/FreeImage/PluginTIFF.cpp:1079
    #12 0x56519de223a1 in FreeImage_Open Source/FreeImage/Plugin.cpp:362
    #13 0x56519de223a1 in FreeImage_LoadFromHandle Source/FreeImage/Plugin.cpp:386
    #14 0x56519de223a1 in FreeImage_LoadFromHandle Source/FreeImage/Plugin.cpp:380
    #15 0x56519de22952 in FreeImage_Load Source/FreeImage/Plugin.cpp:408
    #16 0x56519dddd12b in main /home/lab4/src/freeimage-svn/FreeImage/trunk/load-test.c:16

SUMMARY: AddressSanitizer: heap-buffer-overflow Source/Metadata/FreeImageTag.cpp:274 in FreeImage_SetTagValue
Shadow bytes around the buggy address:
  0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff8000: fa fa 00 00 fa fa fd fa fa fa 01 fa fa fa fd fa
  0x0c047fff8010: fa fa fd fa fa fa fd fa fa fa 02 fa fa fa fd fa
=>0x0c047fff8020: fa fa fd fa fa fa fd fa fa fa[02]fa fa fa fd fa
  0x0c047fff8030: fa fa fd fa fa fa fd fa fa fa 02 fa fa fa fd fa
  0x0c047fff8040: fa fa 00 fa fa fa fd fa fa fa fd fa fa fa 04 fa
  0x0c047fff8050: fa fa 02 fa fa fa fd fa fa fa fd fa fa fa 01 fa
  0x0c047fff8060: fa fa fd fa fa fa 00 fa fa fa fd fa fa fa fd fa
  0x0c047fff8070: fa fa 00 fa fa fa 00 fa fa fa fd fa fa fa fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==44698==ABORTING
Aborted

Reproduce

To reproduce it ,compile FreeImage with ASAN. Then compile and execute the test file in the attachment as follows:

Clang++ -g -fsanitize=address load-test.c -lfreeimage -L. -lm -o load-test
./load-test oob_read_FreeImageTag_274

Credit

ADLab of Venustech

[Hervé Drolon]

fixed with patch https://sourceforge.net/p/freeimage/patches/143/