Tuesday, September 02, 2008
TIFF security
There's a furious discussion in progress on the TIFF mailing list on the security, or lack thereof, of libtiff. The general consensus is that libtiff isn't hardened against hostile files.
No major browser supports TIFF images, using libtiff or anything else, but creators of web applications that convert TIFF files for display should be wary of security issues. Code for displaying traditional Web formats such as GIF, PNG, and JPEG is relatively safe because it's stood the test of many attacks and most of its security-related bugs have been fixed by now. Code for displaying TIFF (libtiff gets singled out only because it's so widely used, not because it's less safe than alternatives) deals with a complex format, and there are many opportunities for false sizes and out-of-bounds pointers to lure an application into executing data.
The problem is that the most efficient code for computation-intensive tasks is written in C, which has often been called a high-level assembly language. It's efficient because it doesn't have any features to protect the code from running past the end of an array or using arbitrary pointers, so it's inherently hard to make C code safe.
One solution is to permit only trusted TIFF files. There's always a chance a hostile file can sneak in, though. None of the solutions are perfect. The same considerations apply to processing any other file format for the Web.
(This is, in part, a note to self for future projects.)
Labels: TIFF
