CVE-2022-4645

An attacker crafts a TIFF file with a malformed TIFFTAG_INKNAMES tag whose value lacks a NUL terminator within the declared buffer length. When the tiffcp utility (tools/tiffcp.c:948) calls strlen() on this buffer, it reads past the allocated heap region, causing a heap-buffer-overflow [ref_id=2]. The overflow is a read of size 1 at the byte immediately after the 15-byte allocation, which results in a denial-of-service (crash) [ref_id=2]. No authentication or special privileges are required; the attacker only needs to deliver the crafted TIFF file to a victim who processes it with tiffcp.

The out-of-bounds read occurs in tools/tiffcp.c at line 948, where strlen() is called on an ink-name buffer that lacks a NUL terminator [ref_id=2]. The root cause is in libtiff's handling of TIFFTAG_INKNAMES in _TIFFVSetField() (libtiff/tif_dir.c), where the old checkInkNamesString() function assumed the buffer contained exactly td_samplesperpixel NUL-terminated names without verifying that a NUL byte exists within the allocated length [ref_id=1].

The commit e8131125 [ref_id=1] replaces the old checkInkNamesString() function with countInkNamesString(), which iterates through the ink-name buffer using a pointer (cp) bounded by the buffer end (ep = s + slen) instead of relying on td_samplesperpixel. It also adds proper validation when setting TIFFTAG_INKNAMES: the new countInkNamesString() returns the number of NUL-separated ink names found, and the code now rejects the tag if no NUL is found at the expected buffer end location. Additionally, TIFFTAG_NUMBEROFINKS is promoted from FIELD_CUSTOM to its own field bit FIELD_NUMBEROFINKS, ensuring consistent handling between InkNames and NumberOfInks tags during both read and write operations [ref_id=1].

1. Compile libtiff 4.3.0 (or 4.4.0) with AddressSanitizer: `export CFLAGS="-O -g -fsanitize=address"` and `./configure --prefix=$PWD/build_asan && make -j64 && make install`. 2. Obtain the PoC file from the issue tracker (attached as `poc_tiffcp_948` in [ref_id=2]). 3. Run `./build_asan/bin/tiffcp poc /tmp/foo`. 4. Observe the ASan report showing a heap-buffer-overflow read at `tiffcp.c:948` in `strlen()` [ref_id=2].