VYPR
← All advisories
Unrated severityNVD Advisory· Published Mar 11, 2022· Updated Aug 2, 2024

CVE-2022-0924

CVE-2022-0924

Description

Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 408976c4.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

36

Patches

Vulnerability mechanics

Root cause

"Missing bounds check in `cpContigBufToSeparateBuf` allows reading past the end of a heap-allocated buffer when processing crafted tile data."

Attack vector

An attacker supplies a crafted TIFF file with malformed tile metadata (e.g., nonstandard tile width, incorrect strip offsets/byte counts) [ref_id=1]. When the `tiffcp` utility processes this file with the `-i -s -p separate` flags, the function `cpContigBufToSeparateBuf` reads beyond the allocated heap buffer, causing a heap-buffer-overflow [ref_id=1]. The overflow is a read of size 1 at an address 0 bytes to the right of a 512-byte region, leading to a denial-of-service via crash [ref_id=1].

Affected code

The out-of-bounds read occurs in the function `cpContigBufToSeparateBuf` at line 1373 of `tools/tiffcp.c` [ref_id=1]. The call chain leading to the bug is `cpContigTiles2SeparateStrips` → `cpImage` → `writeBufferToSeparateStrips` → `cpContigBufToSeparateBuf` [ref_id=1].

What the fix does

The fix is available with commit 408976c4 in the libtiff repository. The patch addresses the missing bounds check in `cpContigBufToSeparateBuf` that allowed reading past the end of the allocated buffer when processing crafted tile data. No further details about the specific diff are present in the supplied bundle.

Preconditions

  • inputThe attacker must provide a crafted TIFF file that triggers malformed tile metadata (nonstandard tile width, incorrect strip offsets/byte counts).
  • configThe victim must run the tiffcp utility with the flags '-i -s -p separate' on the crafted file.

Reproduction

1. Build libtiff 4.3.0 with AddressSanitizer enabled (`CFLAGS="-O -g -fsanitize=address"`). 2. Run `./build_asan/bin/tiffcp -i -s -p separate poc /tmp/foo` where `poc` is the crafted TIFF file. 3. Observe the heap-buffer-overflow error at `cpContigBufToSeparateBuf` in `tools/tiffcp.c:1373` [ref_id=1].

Generated on May 24, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.