While parsing a specially crafted TIFF file, a parser confussion can lead to a heap buffer overflow resulting in out of bounds memory overwrite leading to arbitrary code execution.
Oracle Outside In IX sdk 8.5.1
While parsing a specially crafted TIFF file with ExtraSamples tag present, a parser confusion can lead to insuficient heap memory allocation which later results in a buffer overflow corrupting the heap structures which can be abused to achieve arbitrary code execution. As per the file format documentation ExtraSamples influences how many actual bits per sample there are in the file.
Size of the allocation is based directly on on ImageWidth value (at offset 0x6c in the supplied
testcase) and is the allocation happens in the following basic block in
libvs_tiff.so (image base is
` .text:B74F3DE4 mov edx, [esp+11Ch+var_A8] .text:B74F3DE8 mov eax, [edx+30h] .text:B74F3DEB mov [ebp+4A8h], eax .text:B74F3DF1 mov eax, [edx+30h]  .text:B74F3DF4 mov [esp+11Ch+s], eax .text:B74F3DF7 call _SYSNativeAlloc `
At , the size of the allocation is read from a structure on the heap which comes from the file directly. In the supplied testcase (minimal.tiff) this will be 0x20 bytes, resulting in 0x28 byte chunk being allocated.
The overflow happens in the following code in
` .text:B74EC5A8 add eax, [esp+26Ch+var_188] .text:B74EC5AF movzx eax, byte ptr [eax+esi]  .text:B74EC5B3 mov edx, [esp+26Ch+var_250] .text:B74EC5B7 mov [edx+ecx], al  .text:B74EC5BA .text:B74EC5BA loc_B74EC5BA: ; CODE XREF: VwStreamRead+9F6j .text:B74EC5BA mov ecx, [esp+26Ch+var_220] .text:B74EC5BE movzx eax, word ptr [ecx+0D8h] .text:B74EC5C5 add esi, eax  .text:B74EC5C7 cmp [ecx+3CCh], esi  .text:B74EC5CD jbe loc_B74EC09B `
In the above code, at  a byte value is read from the heap and is written to a destination buffer
at . At ,
edx points at the begining of the previously allocated buffer (as discussed above)
ecx serves as offset, incremented by 1 in each iteration of the loop. This block of code is
executed in a bigger loop, the rest of which is ommited for brevity. At ,
esi, which is a loop
counter (also an index into a buffer at ), is incremented by value in
eax which comes directly
from SamplesPerPixel value in the file (2 in the supplied minimal.tiff). Finally, at , the
esi counter is compared to a max value in
If the maximum value of the counter (
ecx+0x3cc at  above) is greater than the allocated
buffer a heap overflow can occur. Upper bound of this loop is calcualted in the following basic
` .text:B74E8AEF loc_B74E8AEF: .text:B74E8AEF mov ecx, [esp+8Ch+arg_4] .text:B74E8AF6 movzx eax, word ptr [ecx+60h]  .text:B74E8AFA imul eax, [ecx+30h]  .text:B74E8AFE movzx edx, word ptr [ecx+0D8h]  .text:B74E8B05 imul eax, edx  .text:B74E8B08 add eax, 7  .text:B74E8B0B shr eax, 3  .text:B74E8B0E mov [ecx+3CCh], eax  .text:B74E8B14 cmp word ptr [ecx+0F8h], 0 .text:B74E8B1C jnz loc_B74 `
At , the initial value is comes from BitsPerSample value from the file
and is multiplied by a value coming from ImageWidth at . At , a
SamplesPerPixel value is retrieved and is multiplied with previous result at .
After 7 is added at , the final value is divided by 8 at . The final value
is written into heap structure pointed to by
ecx at offset 0x3CC at .
In short, the upper bound for the loop in which the overflow happens is:
` max = (( BitsPerSample * ImageWidth * SamplesPerPixel ) + 7) >> 3 `
In the supplied testcase, the upper bound for the loop is 0x80, and since increment in each iteration is 2 this leads to a buffer overflow of 0x40 bytes where only 0x28 were allocated, leading to an application crash.
In summary, both the size of the allocation and size of the overwrite are under direct control.
The supplied testcase
PoC.tiff demonstrates a more controled buffer overwrite where adjecent
heap chunks are overwriten with ASCII A’s resulting in the following crash:
` Breakpoint 4, 0xb74ec5ba in VwStreamRead () from /home/ea/oit_office/sdk/demo/libvs_tif6.so edx 0x80d8920 135104800 ecx 0x0 0 esi 0x0 0 al 0x4b 75 Quit (gdb) disable (gdb) c Continuing. Export successful: 1 output file(s) created. *** Error in `/home/ea/oit_office/sdk/demo/ixsample': double free or corruption (out): 0x080d8948 *** ======= Backtrace: ========= /usr/lib/libc.so.6(+0x6ce09)[0xb7e20e09] /usr/lib/libc.so.6(+0x74406)[0xb7e28406] /usr/lib/libc.so.6(cfree+0x56)[0xb7e2c676] /home/ea/oit_office/sdk/demo/libwv_core.so(SYSNativeFree+0x1f)[0xb7a507e7] ... Program received signal SIGABRT, Aborted. 0xb7fdbbc0 in __kernel_vsyscall () (gdb) x/x 0x80d8920 0x80d8920: 0xaaaa41aa (gdb) x/x 0x80d8920-4 0x80d891c: 0x00000029 <- size of the overflown buffer (gdb) x/x 0x080d8948 0x80d8948: 0x41414141 (gdb) x/x 0x080d8948-4 0x80d8944: 0x41414141 <- size corrupted (gdb) `
Breakpoint 4 is placed in the loop where the overwrite happens and here shows the initial values.
The pointer to the allocated memory is
0x80d8920. After the crash, by examining
the memory around it, we can see that the adjecent heap chunk has been overwriten.
The essential difference between the original TIFF file and the supplied minimal testcase is that the minimal testcase contains the ExtraSamples tag, which influences the calculations, as well as the different values for both BitsPerSample and SamplesPerPixel values.
This issue can be triggered by running the supplied testcase in the
supplied with the SDK.
2016-04-12 - Vendor Notification
2016-07-19 – Public Disclosure
Discovered by Aleksandar Nikolic of Cisco Talos.