Skip to content

fix(tiff): fix heap overflow unpacking sub-8-bit contig CMYK samples #5296

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lgritz merged 1 commit into from
Jul 4, 2026
Merged

fix(tiff): fix heap overflow unpacking sub-8-bit contig CMYK samples #5296

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions src/tiff.imageio/tiffinput.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2048,14 +2048,17 @@ TIFFInput::read_native_scanline_locked(int subimage, int miplevel, int y,
}

// Handle less-than-full bit depths
bool use_scratch_dest = m_separate
|| (m_photometric == PHOTOMETRIC_SEPARATED
&& !m_raw_color);
if (m_bitspersample < 8) {
// m_scratch now holds nvals n-bit values, contig or separate
m_scratch2.resize(input_bytes);
m_scratch.swap(m_scratch2);
for (int c = 0; c < planes; ++c) /* planes==1 for contig */
bit_convert(m_separate ? m_spec.width : nvals,
&m_scratch2[plane_bytes * c], m_bitspersample,
m_separate
use_scratch_dest
? &m_scratch[plane_bytes * c]
: (unsigned char*)data.data() + plane_bytes * c,
8);
Expand All @@ -2066,7 +2069,7 @@ TIFFInput::read_native_scanline_locked(int subimage, int miplevel, int y,
for (int c = 0; c < planes; ++c) /* planes==1 for contig */
bit_convert(m_separate ? m_spec.width : nvals,
&m_scratch2[plane_bytes * c], m_bitspersample,
m_separate
use_scratch_dest
? &m_scratch[plane_bytes * c]
: (unsigned char*)data.data() + plane_bytes * c,
16);
Expand All @@ -2077,7 +2080,7 @@ TIFFInput::read_native_scanline_locked(int subimage, int miplevel, int y,
for (int c = 0; c < planes; ++c) /* planes==1 for contig */
bit_convert(m_separate ? m_spec.width : nvals,
&m_scratch2[plane_bytes * c], m_bitspersample,
m_separate
use_scratch_dest
? &m_scratch[plane_bytes * c]
: (unsigned char*)data.data() + plane_bytes * c,
32);
Expand Down
17 changes: 17 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff403-b.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,5 +41,22 @@ gps.tif : 64 x 64, 3 channel, uint8 tiff
tiff:RowsPerStrip: 32
iconvert ERROR copying "src/crash-cmyk-e12b.tif" to "out.tif" :
Decoding error at scanline 0, invalid distance too far back
Reading src/crash-cmyk-1bit.tif
src/crash-cmyk-1bit.tif : 73 x 43, 3 channel, uint1 tiff
SHA-1: 7E9169CEC1B8ABD56C3604AAD37761DBD8FE0F2A
channel list: R, G, B
compression: "none"
DocumentName: "flower-separated-contig-08.tif"
Orientation: 1 (normal)
planarconfig: "contig"
ResolutionUnit: "in"
XResolution: 0
YResolution: 72
oiio:BitsPerSample: 1
tiff:ColorSpace: "CMYK"
tiff:Compression: 1
tiff:PhotometricInterpretation: 5
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 28
Comparing "check1.tif" and "ref/check1.tif"
PASS
17 changes: 17 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff403-c.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,5 +41,22 @@ gps.tif : 64 x 64, 3 channel, uint8 tiff
tiff:RowsPerStrip: 32
iconvert ERROR copying "src/crash-cmyk-e12b.tif" to "out.tif" :
Decoding error at scanline 0, invalid distance too far back
Reading src/crash-cmyk-1bit.tif
src/crash-cmyk-1bit.tif : 73 x 43, 3 channel, uint1 tiff
SHA-1: 7E9169CEC1B8ABD56C3604AAD37761DBD8FE0F2A
channel list: R, G, B
compression: "none"
DocumentName: "flower-separated-contig-08.tif"
Orientation: 1 (normal)
planarconfig: "contig"
ResolutionUnit: "in"
XResolution: 0
YResolution: 72
oiio:BitsPerSample: 1
tiff:ColorSpace: "CMYK"
tiff:Compression: 1
tiff:PhotometricInterpretation: 5
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 28
Comparing "check1.tif" and "ref/check1.tif"
PASS
17 changes: 17 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff403.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,5 +41,22 @@ gps.tif : 64 x 64, 3 channel, uint8 tiff
tiff:RowsPerStrip: 32
iconvert ERROR copying "src/crash-cmyk-e12b.tif" to "out.tif" :
Decoding error at scanline 0, invalid distance too far back
Reading src/crash-cmyk-1bit.tif
src/crash-cmyk-1bit.tif : 73 x 43, 3 channel, uint1 tiff
SHA-1: 7E9169CEC1B8ABD56C3604AAD37761DBD8FE0F2A
channel list: R, G, B
compression: "none"
DocumentName: "flower-separated-contig-08.tif"
Orientation: 1 (normal)
planarconfig: "contig"
ResolutionUnit: "in"
XResolution: 0
YResolution: 72
oiio:BitsPerSample: 1
tiff:ColorSpace: "CMYK"
tiff:Compression: 1
tiff:PhotometricInterpretation: 5
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 28
Comparing "check1.tif" and "ref/check1.tif"
PASS
17 changes: 17 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff409.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,5 +41,22 @@ gps.tif : 64 x 64, 3 channel, uint8 tiff
tiff:RowsPerStrip: 32
iconvert ERROR copying "src/crash-cmyk-e12b.tif" to "out.tif" :
Decoding error at scanline 0, invalid distance too far back
Reading src/crash-cmyk-1bit.tif
src/crash-cmyk-1bit.tif : 73 x 43, 3 channel, uint1 tiff
SHA-1: 7E9169CEC1B8ABD56C3604AAD37761DBD8FE0F2A
channel list: R, G, B
compression: "none"
DocumentName: "flower-separated-contig-08.tif"
Orientation: 1 (normal)
planarconfig: "contig"
ResolutionUnit: "in"
XResolution: 0
YResolution: 72
oiio:BitsPerSample: 1
tiff:ColorSpace: "CMYK"
tiff:Compression: 1
tiff:PhotometricInterpretation: 5
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 28
Comparing "check1.tif" and "ref/check1.tif"
PASS
17 changes: 17 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff410.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,5 +41,22 @@ gps.tif : 64 x 64, 3 channel, uint8 tiff
tiff:RowsPerStrip: 32
iconvert ERROR copying "src/crash-cmyk-e12b.tif" to "out.tif" :
Decoding error at scanline 0, invalid distance too far back
Reading src/crash-cmyk-1bit.tif
src/crash-cmyk-1bit.tif : 73 x 43, 3 channel, uint1 tiff
SHA-1: 7E9169CEC1B8ABD56C3604AAD37761DBD8FE0F2A
channel list: R, G, B
compression: "none"
DocumentName: "flower-separated-contig-08.tif"
Orientation: 1 (normal)
planarconfig: "contig"
ResolutionUnit: "in"
XResolution: 0
YResolution: 72
oiio:BitsPerSample: 1
tiff:ColorSpace: "CMYK"
tiff:Compression: 1
tiff:PhotometricInterpretation: 5
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 28
Comparing "check1.tif" and "ref/check1.tif"
PASS
17 changes: 17 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff430.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,5 +56,22 @@ gps.tif : 64 x 64, 3 channel, uint8 tiff
tiff:RowsPerStrip: 32
iconvert ERROR copying "src/crash-cmyk-e12b.tif" to "out.tif" :
Decoding error at scanline 0
Reading src/crash-cmyk-1bit.tif
src/crash-cmyk-1bit.tif : 73 x 43, 3 channel, uint1 tiff
SHA-1: 7E9169CEC1B8ABD56C3604AAD37761DBD8FE0F2A
channel list: R, G, B
compression: "none"
DocumentName: "flower-separated-contig-08.tif"
Orientation: 1 (normal)
planarconfig: "contig"
ResolutionUnit: "in"
XResolution: 0
YResolution: 72
oiio:BitsPerSample: 1
tiff:ColorSpace: "CMYK"
tiff:Compression: 1
tiff:PhotometricInterpretation: 5
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 28
Comparing "check1.tif" and "ref/check1.tif"
PASS
17 changes: 17 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff470-b.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,5 +56,22 @@ gps.tif : 64 x 64, 3 channel, uint8 tiff
tiff:RowsPerStrip: 32
iconvert ERROR copying "src/crash-cmyk-e12b.tif" to "out.tif" :
Decoding error at scanline 0, invalid distance too far back
Reading src/crash-cmyk-1bit.tif
src/crash-cmyk-1bit.tif : 73 x 43, 3 channel, uint1 tiff
SHA-1: 7E9169CEC1B8ABD56C3604AAD37761DBD8FE0F2A
channel list: R, G, B
compression: "none"
DocumentName: "flower-separated-contig-08.tif"
Orientation: 1 (normal)
planarconfig: "contig"
ResolutionUnit: "in"
XResolution: 0
YResolution: 72
oiio:BitsPerSample: 1
tiff:ColorSpace: "CMYK"
tiff:Compression: 1
tiff:PhotometricInterpretation: 5
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 28
Comparing "check1.tif" and "ref/check1.tif"
PASS
17 changes: 17 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff470-c.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,5 +56,22 @@ gps.tif : 64 x 64, 3 channel, uint8 tiff
tiff:RowsPerStrip: 32
iconvert ERROR copying "src/crash-cmyk-e12b.tif" to "out.tif" :
Decoding error at scanline 0, invalid distance too far back
Reading src/crash-cmyk-1bit.tif
src/crash-cmyk-1bit.tif : 73 x 43, 3 channel, uint1 tiff
SHA-1: 7E9169CEC1B8ABD56C3604AAD37761DBD8FE0F2A
channel list: R, G, B
compression: "none"
DocumentName: "flower-separated-contig-08.tif"
Orientation: 1 (normal)
planarconfig: "contig"
ResolutionUnit: "in"
XResolution: 0
YResolution: 72
oiio:BitsPerSample: 1
tiff:ColorSpace: "CMYK"
tiff:Compression: 1
tiff:PhotometricInterpretation: 5
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 28
Comparing "check1.tif" and "ref/check1.tif"
PASS
17 changes: 17 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff470.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,5 +56,22 @@ gps.tif : 64 x 64, 3 channel, uint8 tiff
tiff:RowsPerStrip: 32
iconvert ERROR copying "src/crash-cmyk-e12b.tif" to "out.tif" :
Decoding error at scanline 0
Reading src/crash-cmyk-1bit.tif
src/crash-cmyk-1bit.tif : 73 x 43, 3 channel, uint1 tiff
SHA-1: 7E9169CEC1B8ABD56C3604AAD37761DBD8FE0F2A
channel list: R, G, B
compression: "none"
DocumentName: "flower-separated-contig-08.tif"
Orientation: 1 (normal)
planarconfig: "contig"
ResolutionUnit: "in"
XResolution: 0
YResolution: 72
oiio:BitsPerSample: 1
tiff:ColorSpace: "CMYK"
tiff:Compression: 1
tiff:PhotometricInterpretation: 5
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 28
Comparing "check1.tif" and "ref/check1.tif"
PASS
17 changes: 17 additions & 0 deletions testsuite/tiff-misc/ref/out.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,5 +41,22 @@ gps.tif : 64 x 64, 3 channel, uint8 tiff
tiff:RowsPerStrip: 32
iconvert ERROR copying "src/crash-cmyk-e12b.tif" to "out.tif" :
Decoding error at scanline 0, invalid distance too far back
Reading src/crash-cmyk-1bit.tif
src/crash-cmyk-1bit.tif : 73 x 43, 3 channel, uint1 tiff
SHA-1: 7E9169CEC1B8ABD56C3604AAD37761DBD8FE0F2A
channel list: R, G, B
compression: "none"
DocumentName: "flower-separated-contig-08.tif"
Orientation: 1 (normal)
planarconfig: "contig"
ResolutionUnit: "in"
XResolution: 0
YResolution: 72
oiio:BitsPerSample: 1
tiff:ColorSpace: "CMYK"
tiff:Compression: 1
tiff:PhotometricInterpretation: 5
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 28
Comparing "check1.tif" and "ref/check1.tif"
PASS
8 changes: 8 additions & 0 deletions testsuite/tiff-misc/run.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,4 +32,12 @@
# Test bug with corrupt cmyk file
command += iconvert ("src/crash-cmyk-e12b.tif out.tif", failureok=True)

# Regression test: CMYK (photometric=separated) TIFF missing its
# BitsPerSample tag, which makes libtiff default it to 1 bit/sample. When
# unpacking the sub-8-bit samples for the CMYK->RGB conversion, the bit
# unpacker was writing all 4 input channels' worth of unpacked samples
# directly into the 3-channel RGB output buffer instead of scratch space,
# causing a heap buffer overflow.
command += info_command ("src/crash-cmyk-1bit.tif", safematch=True)

outputs = [ "check1.tif", "out.txt" ]
Binary file added testsuite/tiff-misc/src/crash-cmyk-1bit.tif
View file
Open in desktop
Binary file not shown.
Loading