CVE-2023-0804

An attacker supplies a crafted TIFF file with multiple crop regions of unequal width or length when using the `-E` (edge) composite mode of tiffcrop [ref_id=1][ref_id=2]. The tool fails to validate that all regions have consistent dimensions before copying pixel data, causing `extractContigSamplesShifted24bits` to write past the allocated buffer [ref_id=2]. The attack is triggered by running `tiffcrop -E right -z ... -i -s crafted.tif output.tif` [ref_id=2]. No authentication or special privileges are required; the attacker only needs to deliver the malformed file to a victim who processes it with tiffcrop.

The out-of-bounds write occurs in `extractContigSamplesShifted24bits` at `tools/tiffcrop.c:3609` [ref_id=2]. The call chain is `main` → `processCropSelections` → `extractCompositeRegions` → `extractContigSamplesShifted24bits` [ref_id=2]. The patch modifies `computeInputPixelOffsets` and `extractCompositeRegions` in the same file to add consistency checks on region dimensions before composite processing [ref_id=1].

The patch adds dimension-consistency checks in two functions. In `computeInputPixelOffsets`, after computing each region's `buffsize`, the code now verifies that for `EDGE_LEFT`/`EDGE_RIGHT` all regions have equal `zlength` and for `EDGE_TOP`/`EDGE_BOTTOM` all regions have equal `zwidth`, returning an error if they differ [ref_id=1]. In `extractCompositeRegions`, a new upfront loop checks that all region widths (for top/bottom) or lengths (for left/right) match before any pixel extraction begins, and the existing per-iteration comparison was corrected from comparing against the previous region to comparing against the next region [ref_id=1]. These checks prevent the buffer overrun by rejecting composite operations with mismatched region sizes.

Build libtiff with AddressSanitizer (`CFLAGS="-g -fsanitize=address -fno-omit-frame-pointer" ./configure --disable-shared; make`). Run: `./build_asan/bin/tiffcrop -E right -z 1,1,2048,2048:1,2049,2048,4097 -i -s poc /tmp/foo` using the attached poc.zip [ref_id=2]. The tool will crash with a heap-buffer-overflow at `extractContigSamplesShifted24bits` in `tiffcrop.c:3609` [ref_id=2].