From 0ac97aa7a5bffddd88f7cdbe517264e9db3f5bd5 Mon Sep 17 00:00:00 2001 From: Lee Howard Date: Fri, 5 Sep 2025 21:42:35 +0000 Subject: [PATCH] tiffcrop: fix double-free and memory leak exposed by issue #721 Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/0ac97aa7a5bffddd88f7cdbe517264e9db3f5bd5] CVE: CVE-2025-8961 Signed-off-by: Vijay Anusuri --- tools/tiffcrop.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c index e16bc2d..c7d2553 100644 --- a/tools/tiffcrop.c +++ b/tools/tiffcrop.c @@ -929,6 +929,7 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8_t* buf, TIFFError("readContigTilesIntoBuffer", "Unable to extract row %"PRIu32" from tile %"PRIu32, row, TIFFCurrentTile(in)); + _TIFFfree(tilebuf); return 1; } break; @@ -943,6 +944,7 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8_t* buf, TIFFError("readContigTilesIntoBuffer", "Unable to extract row %"PRIu32" from tile %"PRIu32, row, TIFFCurrentTile(in)); + _TIFFfree(tilebuf); return 1; } break; @@ -957,6 +959,7 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8_t* buf, TIFFError("readContigTilesIntoBuffer", "Unable to extract row %"PRIu32" from tile %"PRIu32, row, TIFFCurrentTile(in)); + _TIFFfree(tilebuf); return 1; } break; @@ -969,6 +972,7 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8_t* buf, TIFFError("readContigTilesIntoBuffer", "Unable to extract row %"PRIu32" from tile %"PRIu32, row, TIFFCurrentTile(in)); + _TIFFfree(tilebuf); return 1; } break; @@ -983,10 +987,12 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8_t* buf, TIFFError("readContigTilesIntoBuffer", "Unable to extract row %"PRIu32" from tile %"PRIu32, row, TIFFCurrentTile(in)); + _TIFFfree(tilebuf); return 1; } break; default: TIFFError("readContigTilesIntoBuffer", "Unsupported bit depth %"PRIu16, bps); + _TIFFfree(tilebuf); return 1; } } @@ -2535,7 +2541,7 @@ main(int argc, char* argv[]) } /* If we did not use the read buffer as the crop buffer */ - if (read_buff) + if (read_buff && read_buff != crop_buff) _TIFFfree(read_buff); if (crop_buff) -- 2.25.1