VYPR
← All advisories
Unrated severityNVD Advisory· Published Mar 11, 2022· Updated Aug 2, 2024

CVE-2022-0909

CVE-2022-0909

Description

Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f8d0f9aa.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

36

Patches

Vulnerability mechanics

Root cause

"Missing division-by-zero check in computeOutputPixelOffsets allows a crafted TIFF file to cause a floating-point exception (FPE)."

Attack vector

An attacker provides a crafted TIFF file and runs `tiffcrop -H 341

Affected code

The vulnerability is in `computeOutputPixelOffsets` in `tools/tiffcrop.c` at line 5802 [ref_id=1]. The crash occurs when `tiffcrop` is invoked with the `-H` flag on a crafted TIFF file [ref_id=1].

What the fix does

The fix is available with commit `f8d0f9aa` in the libtiff repository. The patch addresses the missing division-by-zero check in `computeOutputPixelOffsets` that causes the FPE when processing malformed TIFF files. Users who compile from source should apply this commit; no other remediation details are provided in the bundle.

Preconditions

  • inputAttacker must supply a crafted TIFF file that triggers the divide-by-zero in computeOutputPixelOffsets
  • inputThe tiffcrop tool must be invoked with the -H flag (e.g., -H 341)

Reproduction

Build libtiff with AddressSanitizer enabled (CFLAGS="-g -fsanitize=address -fno-omit-frame-pointer" CXXFLAGS="-g -fsanitize=address -fno-omit-frame-pointer" ./configure --prefix=$PWD/build_asan --disable-shared; make -j; make install; make clean). Then run: `./build_asan/bin/tiffcrop -H 341 poc /tmp/foo` where `poc` is the crafted TIFF file [ref_id=1]. The tool will crash with an FPE at `tools/tiffcrop.c:5802` in `computeOutputPixelOffsets` [ref_id=1].

Generated on May 24, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.