russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.6 KiB

Raw Blame History

libtiff — CWE-407 Disclosure Brief (libtiff-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(D²) defect in libtiff's TIFF directory reader. The duplicate tag detection in TIFFReadDirectory() and TIFFReadCustomDirectory() uses nested loops to compare every tag pair, producing O(D²) total cost where D = directory entry count.

The Defect

libtiff-0001 (PATCHED — MEDIUM): libtiff/tif_dirread.c:4377 (two sites)

// Mark duplicates of any tag to be ignored (bugzilla 1994):
for (ma = dir, mb = 0; mb < dircount; ma++, mb++)
{
    for (na = ma + 1, nb = mb + 1; nb < dircount; na++, nb++)
    {
        if (ma->tdir_tag == na->tdir_tag)
            na->tdir_ignore = TRUE;  // O(D^2) nested comparison
    }
}

The same O(D²) nested loop appears in both TIFFReadDirectory() and TIFFReadCustomDirectory(). For TIFF files with D directory entries, total comparisons reach D*(D-1)/2.

Complexity Proof

At D=500 directory entries:

Defective: 500 × 499 / 2 = 124,750 comparisons
Fixed: O(D log D) sort-based approach = ~4,500 comparisons
~28× op reduction at D=500.

Impact

libtiff is the reference TIFF library used by virtually every image processing application, web browser, and operating system. TIFF files with many directory entries (extended metadata, scientific imaging, geospatial data) hit the quadratic dedup on every file load. Adversarial TIFF files with many entries can trigger denial-of-service through this path.

The Fix

Replace O(D²) nested loops with O(D log D) sorted seen-array approach using binary search for duplicate detection:

// After — O(D log D) sorted seen-array with binary search
uint16_t *seen = _TIFFmallocExt(tif, dircount * sizeof(uint16_t));
// For each entry: binary search in seen[], mark dup or insert
// Fallback to O(D^2) if allocation fails (rare)

Patch

Fix available: defects/libtiff-0001/patch/libtiff-0001-dirread-dedup-O2.patch

Single-file patch in libtiff/tif_dirread.c. Fixes both TIFFReadDirectory() and TIFFReadCustomDirectory(). Includes fallback to original O(D²) if allocation fails. ~28× speedup at D=500 entries.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (libtiff/libtiff).
Assess severity — fires on every TIFF file load with duplicate tags, exploitable for DoS.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the libtiff team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.6 KiB Raw Blame History Unescape Escape