CVE-2022-2953

An attacker provides a crafted TIFF file and invokes `tiffcrop` with a combination of mutually exclusive options such as `-Z 1:4,3:3 -R 90 -H 300 -S 2:2 -i` [ref_id=1]. The tool reads the malformed TIFF, which triggers numerous TIFF tag warnings and errors, then `loadImage` allocates a heap buffer based on the image dimensions [ref_id=1]. When `extractImageSection` later processes the image data using the `-S` (rows/cols) option, it reads beyond the allocated buffer, causing a heap-buffer-overflow [ref_id=1]. The precondition is that the attacker must supply a crafted TIFF file and the victim must run `tiffcrop` with the conflicting option combination.

The vulnerability is in `extractImageSection` at `tools/tiffcrop.c:6905` [ref_id=1]. The heap-buffer-overflow occurs when `tiffcrop` processes a crafted TIFF file with the `-S` option combined with other crop options (`-Z`, `-R`, `-H`) that are supposed to be mutually exclusive [ref_id=1][ref_id=2]. The `loadImage` function allocates a buffer of 1,142,421 bytes, but `extractImageSection` reads one byte past the end of that allocation [ref_id=1].

The fix, commit 48d6ece8, adds the `-S` option to the mutual-exclusivity check in `process_command_opts` [ref_id=2]. Previously the code only checked that `(-X|-Y)`, `-Z`, and `-z` were mutually exclusive; the `-S` option (which sets `PAGE_MODE_ROWSCOLS`) was not included in the validation [ref_id=2]. The patch updates the comment, the `CROP_NONE` definition, the `PAGE_MODE_ROWSCOLS` comment, the usage string, and the validation logic to treat `-S` as mutually exclusive with the other crop options, causing `tiffcrop` to exit with an error if conflicting options are supplied [ref_id=2].

Build libtiff with AddressSanitizer enabled (`CFLAGS="-g -fsanitize=address -fno-omit-frame-pointer"`). Run: `./build_asan/bin/tiffcrop -Z 1:4,3:3 -R 90 -H 300 -S 2:2 -i poc /tmp/foo` where `poc` is the crafted TIFF file [ref_id=1]. The tool will crash with a heap-buffer-overflow at `extractImageSection` in `tiffcrop.c:6905` [ref_id=1].