#349 NULL pointer dereference in FreeImage_CloneTag

[Fedotov Andrey]

Hi!
While doing fuzzing with AFL++ & Sydr I found NULL pointer dereference.

==376630==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7ffff7b0ad82 bp 0x7fffffffd5c0 sp 0x7fffffffcd78 T0)
==376630==The signal is caused by a READ memory access.
==376630==Hint: address points to the zero page.
[Detaching after fork from child process 376691]
    #0 0x7ffff7b0ad82  /build/glibc-eX1tMB/glibc-2.31/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:312
    #1 0x4a6311 in __asan_memcpy /llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3
    #2 0x729290 in FreeImage_CloneTag /freeimage-svn/FreeImage/trunk/Source/Metadata/FreeImageTag.cpp:134:5
    #3 0x4f11bd in FreeImage_SetMetadata /freeimage-svn/FreeImage/trunk/Source/FreeImage/BitmapAccess.cpp:1403:21
    #4 0x73f012 in tiff_read_exif_tag(tiff*, unsigned int, FIBITMAP*, TagLib::MDMODEL) /freeimage-svn/FreeImage/trunk/Source/Metadata/XTIFF.cpp:542:2
    #5 0x73ce29 in tiff_read_exif_tags(tiff*, TagLib::MDMODEL, FIBITMAP*) /freeimage-svn/FreeImage/trunk/Source/Metadata/XTIFF.cpp:612:4
    #6 0x656770 in tiff_read_exif_profile(FreeImageIO*, void*, tiff*, FIBITMAP*) /freeimage-svn/FreeImage/trunk/Source/FreeImage/PluginTIFF.cpp:843:12
    #7 0x654d10 in ReadMetadata(FreeImageIO*, void*, tiff*, FIBITMAP*) /freeimage-svn/FreeImage/trunk/Source/FreeImage/PluginTIFF.cpp:880:2
    #8 0x64e5a2 in Load(FreeImageIO*, void*, int, int, void*) /freeimage-svn/FreeImage/trunk/Source/FreeImage/PluginTIFF.cpp:2320:3
    #9 0x508deb in FreeImage_LoadFromHandle /freeimage-svn/FreeImage/trunk/Source/FreeImage/Plugin.cpp:386:24
    #10 0x4ff0bb in FreeImage_LoadFromMemory /freeimage-svn/FreeImage/trunk/Source/FreeImage/MemoryIO.cpp:88:10
    #11 0x4e0505 in LLVMFuzzerTestOneInput /load_from_memory_tiff_fuzzer.cc:35:26
    #12 0x4e00c4 in main /afl.cc:36:9
    #13 0x7ffff7a730b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16 
    #14 0x425fbd in _start (/load_from_memory_tiff_afl+0x425fbd)

    In File /freeimage-svn/FreeImage/trunk/Source/Metadata/FreeImageTag.cpp:134


    131                                 if(!dst_tag->value) {
    132                                         throw FI_MSG_ERROR_MEMORY;
    133                                 }
--->134                                 memcpy(dst_tag->value, src_tag->value, src_tag->length);
    135                                 break;
    136                 }
    137    
    138                 return clone;
    139    
    140         } catch(const char *message) {
    141                 FreeImage_DeleteTag(clone);
    142                 FreeImage_OutputMessageProc(FIF_UNKNOWN, message);

How to reporduce:

1. Build and run docker container from here https://github.com/ispras/oss-sydr-fuzz/tree/master/projects/freeimage
2. Run fuzzer: /load_from_memory_tiff_afl < crash-e4a3d17537c6bf51cc89d21c15907b79b36aa06b