#348 Multiple heap buffer overflows in AssignPixel

[Fedotov Andrey]

Hi!
While doing fuzzing with AFL++ & Sydr I found multiple heap buffer overflows:

==376631==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x625000002101 at pc 0x00000063a018 bp 0x7fffffffdd50 sp 0x7fffffffdd48                                                                         
READ of size 2 at 0x625000002101 thread T0                                                                                                                                                                         
[Detaching after fork from child process 376679]                                                                                                                                                                   
    #0 0x63a017 in AssignPixel(unsigned char*, unsigned char const*, unsigned int) /freeimage-svn/FreeImage/trunk/Source/Utilities.h:318:38                                                                        
    #1 0x6471cd in Load(FreeImageIO*, void*, int, int, void*) /freeimage-svn/FreeImage/trunk/Source/FreeImage/PluginTIFF.cpp:2021:10                                                                               
    #2 0x508deb in FreeImage_LoadFromHandle /freeimage-svn/FreeImage/trunk/Source/FreeImage/Plugin.cpp:386:24                                                                                                      
    #3 0x4ff0bb in FreeImage_LoadFromMemory /freeimage-svn/FreeImage/trunk/Source/FreeImage/MemoryIO.cpp:88:10                                                                                                     
    #4 0x4e0505 in LLVMFuzzerTestOneInput /load_from_memory_tiff_fuzzer.cc:35:26                                                                                                                                   
    #5 0x4e00c4 in main /afl.cc:36:9                                                                                                                                                                               
    #6 0x7ffff7a730b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16                                                                                                           
    #7 0x425fbd in _start (/load_from_memory_tiff_afl+0x425fbd)

        In File /freeimage-svn/FreeImage/trunk/Source/Utilities.h:318


    315                         break;
    316    
    317                 case 2: // FIT_UINT16 / FIT_INT16 / 16-bit
--->318                         *(reinterpret_cast<WORD*>(dst)) = *(reinterpret_cast<const WORD*> (src));
    319                         break;
    320    
    321                 case 3: // FIT_BITMAP (24-bit)
    322                         *(reinterpret_cast<WORD*>(dst)) = *(reinterpret_cast<const WORD*> (src));
    323                         dst[2] = src[2];
    324                         break;
    325    
    326                 case 4: // FIT_BITMAP (32-bit) / FIT_UINT32 / FIT_INT32 / FIT_FLOAT

There are several crashes in other cases of this switch. Problem looks the same.
How to reporduce:

1. Build and run docker container from here https://github.com/ispras/oss-sydr-fuzz/tree/master/projects/freeimage
2. Run fuzzer: /load_from_memory_tiff_afl < crash-2034313c04c8697411ba9b6d539334655a5ff2dc