#178 CVE-2024-28567: re-fetch TIFF ICC pointer after ExifIFD switch

[Daniel Rosser]

Applies to FreeImage SVN trunk r1911 (also 3.19.0 [r1909]).

CVE-2024-28567 — NVD says FreeImage_CreateICCProfile() overflow. The reproducible ASan hit is a use-after-free of libtiff's ICC pointer.

Load() calls TIFFGetField(TIFFTAG_ICCPROFILE) once, early. ReadMetadata() -> tiff_read_exif_profile() may call TIFFReadEXIFDirectory() when the file has an ExifIFD, which switches directory and back via TIFFFreeDirectory and frees the per-directory field storage iccBuf pointed into. FreeImage_CreateICCProfile(dib, iccBuf, iccSize) then uses a dangling pointer.

This patch re-fetches the ICC field after ReadMetadata() returns to the main IFD.

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-28567

GitHub: https://github.com/danoli3/FreeImage/commit/ce6fe58 (PR https://github.com/danoli3/FreeImage/pull/79)

Apply from the FreeImage tree root:

patch -p0 < CVE-2024-28567.patch

Independent of the TIFF AssignPixel patch (CVE-2024-28566); apply this first if you take both.