VYPR
← All advisories
Unrated severityNVD Advisory· Published Feb 11, 2022· Updated Aug 2, 2024

CVE-2022-0562

CVE-2022-0562

Description

Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

36

Patches

Vulnerability mechanics

Root cause

"Null pointer passed as the source argument to memcpy() in TIFFReadDirectory when td_sampleinfo is NULL but old_extrasamples is non-zero."

Attack vector

An attacker crafts a TIFF file with malformed directory entries that cause `tif->tif_dir.td_sampleinfo` to be NULL while `old_extrasamples` is non-zero. When `tiffinfo` (or any libtiff-based tool) parses this file, the `TIFFReadDirectory` function reaches the `memcpy(new_sampleinfo, tif->tif_dir.td_sampleinfo, ...)` call with a null source pointer, triggering undefined behavior and a crash [ref_id=1]. The attack requires no authentication and is delivered by convincing a user to process the crafted TIFF file.

Affected code

The vulnerability is in the `TIFFReadDirectory` function within `tif_dirread.c` at line 4176. The code passes a null pointer as the second argument to `memcpy()` when copying `tif->tif_dir.td_sampleinfo` into `new_sampleinfo` [ref_id=1].

What the fix does

The fix is available in commit 561599c. The patch adds a null-pointer check before the `memcpy()` call in `TIFFReadDirectory`, ensuring that when `tif->tif_dir.td_sampleinfo` is NULL, the copy is skipped or handled safely. This prevents the undefined behavior that leads to the denial of service [ref_id=1].

Preconditions

  • inputThe victim must process a crafted TIFF file using a libtiff-based tool (e.g., tiffinfo).
  • authNo authentication or special privileges required.

Reproduction

Compile libtiff 4.3.0 with AddressSanitizer and UndefinedBehaviorSanitizer enabled (e.g., `CFLAGS="-g -fsanitize=address,undefined"`). Run `./tiffinfo -f lsb2msb -Dcdjrsz crash.tif` against the crafted POC file from the crash.zip attachment [ref_id=1]. The tool will crash with a runtime error indicating a null pointer passed to `memcpy` at `tif_dirread.c:4176`.

Generated on May 24, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.