CVE-2023-25433

An attacker provides a crafted TIFF file and invokes `tiffcrop` with the `-Z` (crop zone) and `-R` (rotation) options, e.g. `-Z 12:50,12:99 -R 270` [ref_id=1]. The tool reads the malicious image, and during processing `rotateImage()` allocates a buffer based on the pre-rotation dimensions but does not adjust the stored buffer size to reflect the rotated dimensions [ref_id=1]. When `processCropSelections()` later calls `memset` on that buffer using the (now-incorrect) larger size, it writes past the end of the allocated heap region, causing a heap-buffer-overflow and SIGSEGV [ref_id=1]. No authentication or special privileges are required beyond the ability to run `tiffcrop` on the attacker-supplied file.

The vulnerability is in `/libtiff/tools/tiffcrop.c` at line 8499 within the `processCropSelections()` function [ref_id=1]. The ASAN report shows the heap-buffer-overflow occurs during a `memset` call in `processCropSelections`, and the undersized buffer was allocated by `rotateImage()` at line 9605 [ref_id=1]. The root cause is that `rotateImage()` does not correctly update the buffer size metadata after rotation, so the subsequent `memset` in `processCropSelections` writes beyond the allocated region.

The issue report does not include a patch; it documents the heap-buffer-overflow in `processCropSelections()` at line 8499 of `tiffcrop.c` caused by `rotateImage()` failing to update the buffer size after rotation [ref_id=1]. The advisory does not specify a fix. To remediate, the `rotateImage()` function must recalculate and store the new buffer dimensions so that subsequent operations like `memset` in `processCropSelections()` use the correct allocated size [ref_id=1].

Build libtiff from source (version 4.5.0, commit a63e18ca) with AddressSanitizer enabled. Run: `./tools/tiffcrop -Z 12:50,12:99 -R 270 poc /dev/null` where `poc` is the crafted TIFF file attached to the issue [ref_id=1]. The tool will crash with SIGSEGV, and under ASAN it reports a heap-buffer-overflow in `processCropSelections()` at line 8499 [ref_id=1].