CVE-2023-0798

An attacker supplies a crafted TIFF file and invokes `tiffcrop` with options such as `-e multiple -Z 1:4,3:3 -R 270` to trigger cropping and rotation [ref_id=2]. The tool processes the malformed image, and during rotation of a sub-region the `rotateImage()` function incorrectly updates the global `image->width` and `image->length` values. When `extractContigSamplesShifted8bits` later reads pixel data using these corrupted dimensions, it accesses memory beyond the allocated buffer, causing a segmentation fault [ref_id=1][ref_id=2]. No authentication or special privileges are required; the attacker only needs to deliver the file to a victim who runs `tiffcrop` on it.

The out-of-bounds read occurs in `extractContigSamplesShifted8bits` at line 3400 of `tools/tiffcrop.c` [ref_id=2]. The call chain is `main` → `processCropSelections` → `extractSeparateRegion` → `extractContigSamplesShifted8bits` [ref_id=2]. The root cause is that `rotateImage()` previously unconditionally swapped `image->width` and `image->length` even when operating on a sub-region, corrupting the image geometry used by downstream extraction functions [ref_id=1].

The patch adds a `rot_image_params` parameter to `rotateImage()` [ref_id=1]. When this flag is `FALSE` (sub-region rotation), the function no longer modifies `image->width`, `image->length`, `image->xres`, or `image->yres`; it only updates the local width/length pointers [ref_id=1]. Callers that rotate the whole image pass `TRUE`, preserving the old behavior. This prevents the global image dimensions from being corrupted during sub-region rotation, which in turn avoids the out-of-bounds read in `extractContigSamplesShifted8bits` [ref_id=1][ref_id=2].

Build libtiff with AddressSanitizer: `CFLAGS="-g -fsanitize=address -fno-omit-frame-pointer" CXXFLAGS="-g -fsanitize=address -fno-omit-frame-pointer" ./configure --prefix=$PWD/build_asan --disable-shared && make -j && make install`. Then run: `./build_asan/bin/tiffcrop -e multiple -Z 1:4,3:3 -R 270 -i poc /tmp/foo` using the attached `poc.zip` file [ref_id=2]. The tool will crash with a SEGV in `extractContigSamplesShifted8bits` at line 3400 [ref_id=2].