VYPR
← All advisories
Unrated severityNVD Advisory· Published Oct 21, 2022· Updated May 7, 2025

CVE-2022-3598

CVE-2022-3598

Description

LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit cfbb883b.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

39

Patches

Vulnerability mechanics

Root cause

"Insufficient buffer allocation in tiffcrop subroutines — several internal buffers were allocated without the extra 3 bytes needed by functions like extractContigSamplesShifted24bits, leading to an out-of-bounds write when processing crafted TIFF files."

Attack vector

An attacker supplies a crafted TIFF file that triggers the extractContigSamplesShifted24bits function (tools/tiffcrop.c:3604) during tiffcrop processing. Because the internal buffers were allocated without the required 3-byte oversize margin, the function writes beyond the allocated buffer boundary. The precondition is that the victim runs tiffcrop on the malicious file; no authentication or special network access is needed beyond file delivery. The out-of-bounds write can cause a crash (denial-of-service) [ref_id=1].

Affected code

The vulnerable code is in `tools/tiffcrop.c`, specifically the `extractContigSamplesShifted24bits` function at line 3604. The root cause is that multiple internal buffers (e.g., in `readContigTilesIntoBuffer`, `readSeparateTilesIntoBuffer`, `writeBufferToSeparateStrips`, `writeBufferToContigTiles`, `writeBufferToSeparateTiles`, and `readSeparateStripsIntoBuffer`) were allocated without the necessary 3-byte oversize margin required by these extraction subroutines [ref_id=1].

What the fix does

The commit [ref_id=1] introduces a `NUM_BUFF_OVERSIZE_BYTES` constant (value 3) and a compile-time assertion (`assert(NUM_BUFF_OVERSIZE_BYTES >= 3)`) to guarantee the extra padding. Every allocation site that previously used a hardcoded `+3` or no padding is updated to `+ NUM_BUFF_OVERSIZE_BYTES`, and `memset` calls are widened accordingly. This ensures that subroutines such as extractContigSamplesShifted24bits, extractContigSamples32bits, and similar functions always have the 3-byte headroom they require, closing the out-of-bounds write.

Preconditions

  • inputAttacker must supply a crafted TIFF file that triggers the extractContigSamplesShifted24bits code path.
  • networkThe victim must process the malicious file using tiffcrop (e.g., via a service that accepts TIFF uploads).

Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.