Libtiff: out-of-memory in tiffopen via a craft file

An attacker provides a crafted TIFF file smaller than 379 KB to the `TIFFOpen()` API [ref_id=1]. When libtiff reads the directory, `ChopUpSingleUncompressedStrip` attempts to allocate strip arrays based on attacker-controlled image dimensions, causing an unreasonably large memory allocation that exhausts available memory [ref_id=1]. No authentication or special privileges are required; the only precondition is that the victim application calls `TIFFOpen()` on the attacker-supplied file [ref_id=1].

The out-of-memory occurs during `TIFFOpen()` in the call chain `TIFFReadDirectory` → `ChopUpSingleUncompressedStrip` → `allocChoppedUpStripArrays` [ref_id=1]. The ASAN trace shows the allocation originates in `tif_dirread.c` at `allocChoppedUpStripArrays` (line 7267) and `ChopUpSingleUncompressedStrip` (line 7381) [ref_id=1].

The advisory does not include a published patch or specific remediation code [ref_id=1]. The issue was reported against commit `4d0329a4539550f2396772b8c4c60c5fecdda7db` and the recommended fix would involve adding bounds checks in `ChopUpSingleUncompressedStrip` or `allocChoppedUpStripArrays` to validate that the computed allocation size does not exceed a reasonable limit before calling `_TIFFCheckMalloc` [ref_id=1].

Download the PoC input from `https://github.com/PromptFuzz/crash_inputs/raw/main/libtiff/oom1/oom_input` [ref_id=1]. Compile the fuzzer harness with `clang++ -fsanitize=fuzzer,address -g -O0 -I/libtiff/include poc.cc -o poc.out libtiff.a -lz -ljpeg -llzma -ljbig` and run `./poc.out oom_input` to trigger the out-of-memory condition [ref_id=1].