CVE-2023-0803

An attacker supplies a crafted TIFF file with composite crop regions of mismatched dimensions (e.g., different widths for `-E top` or different lengths for `-E left/right`) [ref_id=1][ref_id=2]. When `tiffcrop` is invoked with options such as `-E right -U in -z` and region coordinates that produce unequal region sizes, the missing validation in `extractCompositeRegions` allows a heap-buffer-overflow in `extractContigSamplesShifted16bits` [ref_id=2]. The attacker does not need authentication; the only precondition is that the victim runs `tiffcrop` on the malicious file [ref_id=2].

The vulnerability resides in `tools/tiffcrop.c` at line 3516, in the function `extractContigSamplesShifted16bits` [ref_id=2]. The crash occurs when `extractCompositeRegions` (line 6801) calls this function without ensuring that the composite region dimensions are consistent, leading to an out-of-bounds write [ref_id=2]. The patch modifies `computeInputPixelOffsets` and `extractCompositeRegions` to validate that region widths/lengths are equal before processing composite images [ref_id=1].

The fix adds consistency checks in two functions. In `computeInputPixelOffsets`, when `crop->img_mode == COMPOSITE_IMAGES`, the patch verifies that for `EDGE_LEFT`/`EDGE_RIGHT` all regions have equal `zlength`, and for `EDGE_TOP`/`EDGE_BOTTOM` all regions have equal `zwidth`, returning an error if they differ [ref_id=1]. In `extractCompositeRegions`, a new upfront loop checks that all region widths (for top/bottom) or lengths (for left/right) match before any processing begins, and the existing per-iteration check is corrected to compare against the next region rather than the previous one [ref_id=1]. These changes prevent the buffer overrun by rejecting composite region sets with inconsistent dimensions.

Build libtiff with AddressSanitizer (`CFLAGS="-g -fsanitize=address -fno-omit-frame-pointer" ./configure --disable-shared; make`). Run: `./build_asan/bin/tiffcrop -E right -U in -z 1,1,2048,2048:1,2049,2048,4097 -i poc /tmp/foo` using the provided poc.zip file [ref_id=2]. The tool will output TIFF warnings and then crash with a heap-buffer-overflow in `extractContigSamplesShifted16bits` at `tiffcrop.c:3516` [ref_id=2].