VYPR
← All advisories
Unrated severityNVD Advisory· Published Feb 11, 2022· Updated Aug 2, 2024

CVE-2022-0561

CVE-2022-0561

Description

Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

44

Patches

Vulnerability mechanics

Root cause

"Null pointer passed as the source argument to memcpy() in TIFFFetchStripThing()/TIFFReadDirectory when td_sampleinfo is uninitialized."

Attack vector

An attacker crafts a malicious TIFF image that triggers a code path in `TIFFReadDirectory` where `tif->tif_dir.td_sampleinfo` is null but the function still attempts to copy from it via `memcpy` [ref_id=1]. The attacker delivers the file to a victim who processes it with a libtiff-based tool (e.g., `tiffinfo -f lsb2msb -Dcdjrsz crash.tif`). The null-pointer dereference inside `memcpy` causes undefined behavior, typically resulting in a crash (Denial of Service) [ref_id=1]. No authentication or special network access is required beyond the ability to supply the crafted TIFF file.

Affected code

The vulnerability resides in `tif_dirread.c` within the `TIFFReadDirectory` function, specifically at line 4176 where `memcpy` is called. The call `memcpy(new_sampleinfo, tif->tif_dir.td_sampleinfo, ...)` passes a null pointer as the second argument (`tif->tif_dir.td_sampleinfo`) when the `td_sampleinfo` field has not been properly initialized [ref_id=1].

What the fix does

The fix is available in commit `eecb0712`. The patch ensures that before the `memcpy` call at line 4176, the code checks whether `tif->tif_dir.td_sampleinfo` is non-null, or it allocates/initializes the pointer so that a null pointer is never passed to `memcpy`. This prevents the undefined behavior and crash that occurred when a crafted TIFF file caused `td_sampleinfo` to remain uninitialized while the code path still attempted to copy from it [ref_id=1].

Preconditions

  • inputThe victim must process a crafted TIFF file using a libtiff-based tool (e.g., tiffinfo).
  • configThe libtiff version must be between 3.9.0 and 4.3.0 (inclusive).

Generated on May 24, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.