Skip to content

fix(tiff): fix buffer overrun and make better error reporting #5082

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lgritz merged 1 commit into from
Mar 16, 2026
+82 −12
Merged

fix(tiff): fix buffer overrun and make better error reporting #5082

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 3 additions & 12 deletions src/tiff.imageio/tiffinput.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1973,9 +1973,7 @@ TIFFInput::read_native_scanline_locked(int subimage, int miplevel, int y,
for (int c = 0; c < planes; ++c) { /* planes==1 for contig */
if (TIFFReadScanline(m_tif, &m_scratch[0], m_next_scanline, c)
< 0) {
#if OIIO_TIFFLIB_VERSION < 40500
errorfmt("{}", oiio_tiff_last_error());
#endif
return false;
}
}
Expand All @@ -1989,9 +1987,7 @@ TIFFInput::read_native_scanline_locked(int subimage, int miplevel, int y,
if (m_photometric == PHOTOMETRIC_PALETTE) {
// Convert from palette to RGB
if (TIFFReadScanline(m_tif, m_scratch.data(), y) < 0) {
#if OIIO_TIFFLIB_VERSION < 40500
errorfmt("{}", oiio_tiff_last_error());
#endif
return false;
}
size_t n(m_spec.width);
Expand Down Expand Up @@ -2023,9 +2019,7 @@ TIFFInput::read_native_scanline_locked(int subimage, int miplevel, int y,
// only do one TIFFReadScanline.
for (int c = 0; c < planes; ++c) { /* planes==1 for contig */
if (TIFFReadScanline(m_tif, &readbuf[plane_bytes * c], y, c) < 0) {
#if OIIO_TIFFLIB_VERSION < 40500
errorfmt("{}", oiio_tiff_last_error());
#endif
return false;
}
}
Expand Down Expand Up @@ -2388,9 +2382,7 @@ TIFFInput::read_native_tile_locked(int subimage, int miplevel, int x, int y,
if (m_photometric == PHOTOMETRIC_PALETTE) {
// Convert from palette to RGB
if (TIFFReadTile(m_tif, m_scratch.data(), x, y, z, 0) < 0) {
#if OIIO_TIFFLIB_VERSION < 40500
errorfmt("{}", oiio_tiff_last_error());
#endif
return false;
}
if (m_bitspersample <= 8)
Expand All @@ -2405,21 +2397,20 @@ TIFFInput::read_native_tile_locked(int subimage, int miplevel, int x, int y,
// Not palette
imagesize_t plane_bytes = m_spec.tile_pixels() * m_spec.format.size();
int planes = m_separate ? m_inputchannels : 1;
std::vector<unsigned char> scratch2(m_separate ? m_spec.tile_bytes()
std::vector<unsigned char> scratch2(m_separate ? plane_bytes * planes
: 0);
// Where to read? Directly into user data if no channel shuffling
// or bit shifting is needed, otherwise into scratch space.
unsigned char* readbuf = (no_bit_convert && !m_separate)
unsigned char* readbuf = (no_bit_convert && !m_separate
&& m_inputchannels == m_spec.nchannels)
? (unsigned char*)data.data()
: m_scratch.data();
// Perform the reads. Note that for contig, planes==1, so it will
// only do one TIFFReadTile.
for (int c = 0; c < planes; ++c) /* planes==1 for contig */
if (TIFFReadTile(m_tif, &readbuf[plane_bytes * c], x, y, z, c)
< 0) {
#if OIIO_TIFFLIB_VERSION < 40500
errorfmt("{}", oiio_tiff_last_error());
#endif
return false;
}
if (m_bitspersample < 8) {
Expand Down
2 changes: 2 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff403-b.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,5 +39,7 @@ gps.tif : 64 x 64, 3 channel, uint8 tiff
tiff:PhotometricInterpretation: 2
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 32
iconvert ERROR copying "src/crash-cmyk-e12b.tif" to "out.tif" :
Decoding error at scanline 0, invalid distance too far back
Comparing "check1.tif" and "ref/check1.tif"
PASS
2 changes: 2 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff403-c.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,5 +39,7 @@ gps.tif : 64 x 64, 3 channel, uint8 tiff
tiff:PhotometricInterpretation: 2
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 32
iconvert ERROR copying "src/crash-cmyk-e12b.tif" to "out.tif" :
Decoding error at scanline 0, invalid distance too far back
Comparing "check1.tif" and "ref/check1.tif"
PASS
2 changes: 2 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff403.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,5 +39,7 @@ gps.tif : 64 x 64, 3 channel, uint8 tiff
tiff:PhotometricInterpretation: 2
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 32
iconvert ERROR copying "src/crash-cmyk-e12b.tif" to "out.tif" :
Decoding error at scanline 0, invalid distance too far back
Comparing "check1.tif" and "ref/check1.tif"
PASS
2 changes: 2 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff409.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,5 +39,7 @@ gps.tif : 64 x 64, 3 channel, uint8 tiff
tiff:PhotometricInterpretation: 2
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 32
iconvert ERROR copying "src/crash-cmyk-e12b.tif" to "out.tif" :
Decoding error at scanline 0, invalid distance too far back
Comparing "check1.tif" and "ref/check1.tif"
PASS
2 changes: 2 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff410.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,5 +39,7 @@ gps.tif : 64 x 64, 3 channel, uint8 tiff
tiff:PhotometricInterpretation: 2
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 32
iconvert ERROR copying "src/crash-cmyk-e12b.tif" to "out.tif" :
Decoding error at scanline 0, invalid distance too far back
Comparing "check1.tif" and "ref/check1.tif"
PASS
2 changes: 2 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff430.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,5 +54,7 @@ gps.tif : 64 x 64, 3 channel, uint8 tiff
tiff:PhotometricInterpretation: 2
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 32
iconvert ERROR copying "src/crash-cmyk-e12b.tif" to "out.tif" :
Decoding error at scanline 0
Comparing "check1.tif" and "ref/check1.tif"
PASS
60 changes: 60 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff470-b.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,60 @@
Reading src/separate.tif
src/separate.tif : 128 x 128, 3 channel, uint8 tiff
SHA-1: 486088DECAE711C444FDCAB009C378F7783AD9C5
channel list: R, G, B
compression: "zip"
DateTime: "2020:10:25 15:32:04"
Orientation: 1 (normal)
planarconfig: "separate"
Software: "OpenImageIO 2.3.0dev : oiiotool --pattern fill:topleft=0,0,0:topright=1,0,0:bottomleft=0,1,0:bottomright=1,1,1 128x128 3 --planarconfig separate -scanline -attrib tiff:rowsperstrip 17 -d uint8 -o separate.tif"
oiio:BitsPerSample: 8
tiff:Compression: 8
tiff:PhotometricInterpretation: 2
tiff:PlanarConfiguration: 2
tiff:RowsPerStrip: 7
Comparing "src/separate.tif" and "separate.tif"
PASS
oiiotool ERROR: read : No support for data format of "src/corrupt1.tif"
Full command line was:
> oiiotool --oiioattrib try_all_readers 0 --info -v src/corrupt1.tif
oiiotool ERROR: read : File does not exist: "src/crash-1633.tif"
Full command line was:
> oiiotool --oiioattrib try_all_readers 0 --info -v src/crash-1633.tif
oiiotool ERROR: read : File does not exist: "src/crash-1643.tif"
Full command line was:
> oiiotool --oiioattrib try_all_readers 0 --info src/crash-1643.tif -o out.exr
iconvert ERROR copying "src/crash-1709.tif" to "crash-1709.exr" :

Reading gps.tif
gps.tif : 64 x 64, 3 channel, uint8 tiff
channel list: R, G, B
compression: "zip"
Orientation: 1 (normal)
planarconfig: "contig"
Exif:ColorSpace: 1
Exif:SubjectDistance: 0 (0 m)
GPS:Altitude: 2377 (2377 m)
GPS:DestBearing: 0
GPS:DestBearingRef: "T" (true north)
GPS:DestDistance: 0
GPS:DestDistanceRef: "K" (km)
GPS:DestLatitude: 0, 0, 0
GPS:DestLatitudeRef: "N"
GPS:DestLongitude: 0, 0, 0
GPS:DestLongitudeRef: "E"
GPS:Latitude: 40, 2, 22.686
GPS:LatitudeRef: "N"
GPS:Longitude: 105, 15, 10.152
GPS:LongitudeRef: "W"
GPS:Track: 146.254
GPS:TrackRef: "T" (true north)
oiio:BitsPerSample: 8
oiio:ColorSpace: "srgb_rec709_scene"
tiff:Compression: 8
tiff:PhotometricInterpretation: 2
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 32
iconvert ERROR copying "src/crash-cmyk-e12b.tif" to "out.tif" :
Decoding error at scanline 0, invalid distance too far back
Comparing "check1.tif" and "ref/check1.tif"
PASS
2 changes: 2 additions & 0 deletions testsuite/tiff-misc/ref/out-libtiff470.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,5 +54,7 @@ gps.tif : 64 x 64, 3 channel, uint8 tiff
tiff:PhotometricInterpretation: 2
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 32
iconvert ERROR copying "src/crash-cmyk-e12b.tif" to "out.tif" :
Decoding error at scanline 0
Comparing "check1.tif" and "ref/check1.tif"
PASS
2 changes: 2 additions & 0 deletions testsuite/tiff-misc/ref/out.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,5 +39,7 @@ gps.tif : 64 x 64, 3 channel, uint8 tiff
tiff:PhotometricInterpretation: 2
tiff:PlanarConfiguration: 1
tiff:RowsPerStrip: 32
iconvert ERROR copying "src/crash-cmyk-e12b.tif" to "out.tif" :
Decoding error at scanline 0, invalid distance too far back
Comparing "check1.tif" and "ref/check1.tif"
PASS
3 changes: 3 additions & 0 deletions testsuite/tiff-misc/run.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,4 +29,7 @@
command += oiiotool ("src/gps.tif -o gps.tif")
command += info_command ("gps.tif", safematch=True, hash=False)

# Test bug with corrupt cmyk file
command += iconvert ("src/crash-cmyk-e12b.tif out.tif", failureok=True)

outputs = [ "check1.tif", "out.txt" ]
Binary file added testsuite/tiff-misc/src/crash-cmyk-e12b.tif
View file
Open in desktop
Binary file not shown.
Loading