(CVE-2019-11459) Uninitialized memory read in tiff_document_render()

Initial report:

Hi,

Hereby, I am reporting a small vulnerability that I have discovered in evince.

The vulnerability is that uninitialized heap memory is blit to display on an invalid tiff image.

This is due to missing error checking at [1].

A worst case scenario is that an attacker may use this to guess addresses on heap or see images that have previously been loaded to heap.

Attached is a script that produces a tiff file which has enough fields to get to this codepath.

To observe the effect of uninitialized memory, open the image in evince and press CTRL+R to reload the image.

For discovery credits, please use "Andy Nguyen of ETH Zurich".

Kindly let me know how I can help you.

Best regards, Andy Nguyen

[1] https://gitlab.gnome.org/GNOME/evince/blob/master/backend/tiff/tiff-document.c#L303

Follow-up:

Hi Michael and German,

We must abort and return error if TIFFReadRGBAImageOriented returns 0 (see [1]). There's another call to TIFFReadRGBAImageOriented is at [2] which must be fixed too.

Furthermore, I have just noticed that certain PostScript files show the same behaviour. Open [3] with evince and zoom in/out to see how different images show up. I have not yet analyzed this one, and don't know if it's also due to missing error checking, or if it's an error within libspectre.

Best regards, Andy Nguyen

[1] https://gitlab.com/libtiff/libtiff/blob/master/tools/tiff2pdf.c#L2663 [2] https://gitlab.gnome.org/GNOME/evince/blob/master/backend/tiff/tiff-document.c#L390 [3] https://www.tug.org/svn/texlive/trunk/Build/source/texk/dvipsk/special.lpro?revision=36880&view=markup