search

OSGeo / libgeotiff

Official repository of the libgeotiff project
180 stars 69 forks source link

Vulnerabilities #66

Closed jdefrancesco closed 2 years ago

jdefrancesco commented 2 years ago

I have found an Out-Of-Bound Read; potential vulnerabilities. Do you have somewhere else you wish them to be reported for fixing?

rouault commented 2 years ago

here is fine

jdefrancesco commented 2 years ago

Will do.. Screen Shot 2022-02-23 at 2 01 52 PM

Seems you have an off by one OOB read. You can see I can control the values of sptr which we read from on line 229 of geo_print.c If you wan't I can send you over the crash file.

rouault commented 2 years ago

`` If you wan't I can send you over the crash file.

please attach it here

jdefrancesco commented 2 years ago

GEOTIFFCrashes.zip I have attached a zip files with 10 crashes but they are all related to the same thing. My apologies for the delay in timing from when I first reported. Became bogged down by a couple other things. Didn't mean to keep you waiting.