#333 Crash with TIFF file with large EXIF data

[Joachim Reichel]

The attached TIFF file causes a crash with FreeImage SVN r1859. The crash goes away if I remove the EXIF data with "exiv2 rm".

SVN r1859 claim to contain libtiff 4.1.0, but I see unexplained differences between "Source/LibTIFF4" and "libtiff" from http://download.osgeo.org/libtiff/tiff-4.1.0.tar.gz . Same for SVN r1889 and tiff-4.3.0.tar.gz. Interestingly, the crash goes away if I copy the content of the "libtiff" directory over the existing files in "Source/LibTIFF4". Maybe FreeImage should re-sync its copy of the TIFF library and eliminate any unexplained differences.

[Sebastian Koerner]

This looks like a very late effect after a heap corruption. It is an issue that appears when reading custom TIFF fields. During libTIFF's clear field operations a pointer in a custom tag section is about to be free()'s that has already been freed.
For me the patch of https://sourceforge.net/p/freeimage/patches/152/ fixes the issue for libtiff 4.2-4.4.