CVE-2023-0799

An attacker supplies a crafted TIFF file and invokes `tiffcrop` with options such as `-e multiple -z ... -R 270` to trigger cropping and rotation [ref_id=2]. The tool processes the image through `processCropSelections`, which calls `rotateImage()` on a crop region; `rotateImage()` frees the region's buffer while the code later reads from the same freed pointer in `extractContigSamplesShifted32bits` [ref_id=2]. This heap-use-after-free results in a denial-of-service (crash) when the attacker's file is processed [ref_id=2]. No authentication or special privileges are required beyond the ability to supply the malicious TIFF to the `tiffcrop` utility.

The out-of-bounds read occurs in `extractContigSamplesShifted32bits` at `tools/tiffcrop.c:3701` [ref_id=2]. The root cause is a use-after-free: `rotateImage()` frees the buffer previously allocated for a crop region, but the code in `processCropSelections` and `extractSeparateRegion` continues to access the freed buffer via `crop->regionlist[i].buffptr` [ref_id=2]. The patch modifies `rotateImage()` to accept a new `rot_image_params` parameter and stops unconditionally swapping `image->width`/`image->length`/resolution values when rotating individual crop regions, preventing the premature free that leads to the use-after-free [patch_id=afaabc3e].

The patch adds a `rot_image_params` parameter to `rotateImage()` and passes `TRUE` only when rotating the whole input image, not individual crop regions [patch_id=afaabc3e]. Previously `rotateImage()` always swapped `image->width`, `image->length`, and resolution values, which could cause the buffer to be freed prematurely. By guarding those assignments with `if (rot_image_params)`, the fix ensures that when rotating a sub-region the image-level parameters are not toggled, preventing the use-after-free in `extractContigSamplesShifted32bits` [patch_id=afaabc3e][ref_id=2].

Build libtiff with AddressSanitizer enabled (`CFLAGS="-g -fsanitize=address -fno-omit-frame-pointer" ./configure --prefix=$PWD/build_asan --disable-shared; make -j; make install`). Run: `./build_asan/bin/tiffcrop -e multiple -z 1,1,2048,2048:1,2049,2048,4097 -R 270 -i poc /tmp/foo` using the provided `poc.zip` file [ref_id=2]. The tool will crash with a heap-use-after-free at `tools/tiffcrop.c:3701` in `extractContigSamplesShifted32bits` [ref_id=2].