Carlini

The `ImagingJpegEncode()` function in `src/libImaging/JpegEncode.c` can call `jpeg write marker()` for a JPEG COM comment when an ICC profile exactly fills the 65536-byte encoder buffer. This causes `libjpeg` to write one byte before checking the `free in buffer` counter, which then wraps and allows an attacker-controlled comment and compressed image data to overwrite adjacent heap memory. Re-saving an untrusted image as JPEG while preserving its ICC profile and forwarded comment can lead to a process crash or potential code execution depending on the runtime and heap layouts.

A memory disclosure and segmentation fault issue exists when the software re-saves images as TIFF files using the libtiff encoder. The problem occurs in the `PyImaging LibTiffEncoderNew()` function within `src/encode.c` because the encoder does not correctly verify if the Python value being passed to the variadic `TIFFSetField()` function matches the field definition expected by libtiff. An attacker can provide a crafted TIFF file containing specific tags that trigger this mismatch. For example, if a tag is defined by libtiff as a counted array but is passed as a scalar, libtiff may interpret the scalar value as a byte count and copy an arbitrary amount of process memory from a stale pointer into the output file. Alternatively, if a tag is defined as a fixed-size array, the scalar value may be used as a source memory address, leading to a process crash (SIGSEGV). Technical details include: - **Vulnerable Function**: `PyImaging LibTiffEncoderNew()` - **Vulnerable Parameters**: Crafted TIFF tags such as `DNGPrivateData` (50740) and `ActiveArea` (50829). - **Impact**: This can lead to a complete ASLR bypass by leaking pointers from ` imaging.so`, libpython, libc, and libtiff, or cause a denial of service via process crashes.

Pillow contains an out-of-bounds read issue when decoding certain malformed compressed TIFF files. The problem occurs in the ` decodeTile()` and ` decodeAsRGBA()` functions within `src/libImaging/TiffDecode.c`. When Pillow and libtiff interpret duplicated `PhotometricInterpretation` or `BitsPerSample` tags differently, Pillow may fail to verify that the required input row fits within the buffer produced by libtiff. An attacker can exploit this by providing a crafted TIFF file that causes the unpacker to read past the end of a heap buffer. This can result in fragments of the process's heap memory, including pointer values, being copied into the output image pixels. In cases where the file is larger, it can lead to a process crash (segmentation fault).

Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. This occurs because the ` decodeStrip` and ` decodeTile` buffers may be larger than the bytes written by libtiff, and Pillow converts the expected rows without clearing the unwritten tail. An attacker can provide a crafted TIFF file to an application that loads and returns or re-encodes pixels, potentially disclosing stale heap contents without causing memory corruption or a process crash.

A heap buffer overflow and stale-heap disclosure exist in the ` tiffWriteProc` function when saving compressed TIFF data through libtiff to a target lacking a usable `fileno()`, such as `BytesIO`. The callback determines allocation size based on the prior buffer size rather than the current write position. This allows an attacker-controlled out-of-line TIFF tag or retained ICC profile to be copied beyond the allocation after libtiff seeks forward, which can lead to process crashes or remote code execution. Additionally, unwritten alignment gaps in compressed TIFF output exceeding 64 KiB can disclose stale heap bytes. File paths and targets with real file descriptors are not affected.