#342 Tiff TIFFVGetField loads garbage values

[Thomas Quante]

Hi all,

In case a TIFF Image file has a field which is undefined (field_type == TIFF_UNDEFINED) the resulting values of TIFFVGetField are garbage values. I have an image which has an undefined icc profile which lead to a crash in FreeImage_CreateICCProfile because of the garbage values.

TIFFVGetField(TIFF* tif, uint32 tag, va_list ap) could be fixed by checking if the found field has a field_type != TIFF_UNDEFINED. In this case the image loads fine with no crashes. Unfortunately I cannot share the image due to copyright reasons.

[Mihail Naydenov]

Hi, undefined tags are not garbage in TIFF, they are simply unknown. Also even garbage icc profile should not make FreeImage crash. If you are able to preproduce the scenario with another image it will be great.

[Thomas Quante]

Hi, my bad for not being clear about that the structure itself seems to have sensible values, but the resulting size and ptr of the buffer is garbage. I know it is garbage, because FreeImage_CreateICCProfile crashes during the memcpy call. The contents of the structure can be seen in the attached picture.

[Mihail Naydenov]

Can you copy the image then edit out the sensitive data (pixels/metadata) and upload it so we will have something to work with. Parsing TIFF tags is not a trivial task and we have to see what is going on.