# CVE-2016-9297
## Description
CVE: https://www.cve.org/CVERecord?id=CVE-2016-9297
# Compile
## Download
虽然 Mitre 的 description 写是 4.0.6 版本的漏洞，但是 chall 的 description 说 4.
0.4，那就用 4.0.4 吧。
```shellsession
git clone https://gitlab.com/libtiff/libtiff.git && cd libtiff
git checkout v4.0.4
```
## Build
```shellsession
mkdir ../libtiff-build-fuzz
cd ../libtiff-build-fuzz
CC=afl-clang-lto
CXX=afl-clang-lto++
../libtiff/configure
--prefix="$(realpath ../libtiff-fuzz)"
--disable-shared
make clean && make -j`nproc` && make install
mkdir ../libtiff-build-fuzz-asan
cd ../libtiff-build-fuzz-asan
AFL_USE_ASAN=1
CC=afl-clang-lto
CXX=afl-clang-lto++
../libtiff/configure
--prefix="$(realpath ../libtiff-fuzz-asan)"
--disable-shared
make clean && AFL_USE_ASAN=1 make -j`nproc` && AFL_USE_ASAN=1 make install
```
make 的时候遇到两个定义不完整的报错，直接在 `tif_predict.h` 中加入下面两行即可：
```c
#include "tiffio.h"
#include "tiffiop.h"
```
# Samples
```python
#!/usr/bin/env python
import os
import subprocess
import struct
def run_cmd(cmd):
try:
subprocess.run(cmd, check=True, capture_output=True)
except subprocess.CalledProcessError as e:
print(f"Error running {' '.join(cmd)}: {e}")
def create_minimal_tiff(filename, width=8, height=8):
# Minimal 8x8 BW TIFF (1 bit per pixel)
# Header
header = b'II' + struct.pack('<HI', 42, 8) # II, 42, offset to IFD=8
# IFD
num_entries = 11
ifd_offset = 8
next_ifd_offset = 0
# Tags:
# 256 (Width), 257 (Height), 258 (BitsPerSample), 259 (Compression),
# 262 (Photometric), 273 (StripOffsets), 277 (SamplesPerPixel),
# 278 (RowsPerStrip), 279 (StripByteCounts), 282 (XRes), 283 (YRes)
# Each entry is 12 bytes
entries = []
def add_entry(tag, type, count, value):
entries.append(struct.pack('<HHII', tag, type, count, value))
add_entry(256, 3, 1, width) # Width
add_entry(257, 3, 1, height) # Height
add_entry(258, 3, 1, 1) # BitsPerSample
add_entry(259, 3, 1, 1) # Compression (None)
add_entry(262, 3, 1, 1) # Photometric (MinIsBlack)
add_entry(273, 4, 1, 8 + 2 + num_entries*12 + 4 + 16) # StripOffsets (after
IFD and Res values)
add_entry(277, 3, 1, 1) # SamplesPerPixel
add_entry(278, 3, 1, height) # RowsPerStrip
add_entry(279, 4, 1, (width * height + 7) // 8) # StripByteCounts
add_entry(282, 5, 1, 8 + 2 + num_entries*12 + 4) # XRes (offset)
add_entry(283, 5, 1, 8 + 2 + num_entries*12 + 4 + 8) # YRes (offset)
ifd = struct.pack('<H', num_entries) + b''.join(entries) + struct.pack('<I',
next_ifd_offset)
# Rational values for XRes, YRes (72/1)
res_values = struct.pack('<IIII', 72, 1, 72, 1)
# Image data (all zeros for simplicity)
data = b'x00' * ((width * height + 7) // 8)
with open(filename, 'wb') as f:
f.write(header)
f.write(ifd)
f.write(res_values)
f.write(data)
def create_grayscale_tiff(filename, width=8, height=8, bpp=8):
# Header
header = b'II' + struct.pack('<HI', 42, 8)
num_entries = 11
entries = []
def add_entry(tag, type, count, value):
entries.append(struct.pack('<HHII', tag, type, count, value))
data_offset = 8 + 2 + num_entries*12 + 4 + 16
add_entry(256, 3, 1, width) # Width
add_entry(257, 3, 1, height) # Height
add_entry(258, 3, 1, bpp) # BitsPerSample
add_entry(259, 3, 1, 1) # Compression
add_entry(262, 3, 1, 1) # Photometric (MinIsBlack)
add_entry(273, 4, 1, data_offset) # StripOffsets
add_entry(277, 3, 1, 1) # SamplesPerPixel
add_entry(278, 3, 1, height) # RowsPerStrip
add_entry(279, 4, 1, width * height * (bpp // 8)) # StripByteCounts
add_entry(282, 5, 1, 8 + 2 + num_entries*12 + 4) # XRes
add_entry(283, 5, 1, 8 + 2 + num_entries*12 + 4 + 8) # YRes
ifd = struct.pack('<H', num_entries) + b''.join(entries) + struct.pack('<I',
0)
res_values = struct.pack('<IIII', 72, 1, 72, 1)
data = b'x80' * (width * height * (bpp // 8)) # Gray data
with open(filename, 'wb') as f:
f.write(header)
f.write(ifd)
f.write(res_values)
f.write(data)
def create_rgb_tiff(filename, width=8, height=8):
header = b'II' + struct.pack('<HI', 42, 8)
num_entries = 12
entries = []
def add_entry(tag, type, count, value):
entries.append(struct.pack('<HHII', tag, type, count, value))
bps_offset = 8 + 2 + num_entries*12 + 4
res_offset = bps_offset + 6
data_offset = res_offset + 16
add_entry(256, 3, 1, width) # Width
add_entry(257, 3, 1, height) # Height
add_entry(258, 3, 3, bps_offset) # BitsPerSample (3 values)
add_entry(259, 3, 1, 1) # Compression
add_entry(262, 3, 1, 2) # Photometric (RGB)
add_entry(273, 4, 1, data_offset) # StripOffsets
add_entry(277, 3, 1, 3) # SamplesPerPixel
add_entry(278, 3, 1, height) # RowsPerStrip
add_entry(279, 4, 1, width * height * 3) # StripByteCounts
add_entry(282, 5, 1, res_offset) # XRes
add_entry(283, 5, 1, res_offset + 8) # YRes
add_entry(284, 3, 1, 1) # PlanarConfig (Contig)
ifd = struct.pack('<H', num_entries) + b''.join(entries) + struct.pack('<I',
0)
bps_values = struct.pack('<HHH', 8, 8, 8)
res_values = struct.pack('<IIII', 72, 1, 72, 1)
data = b'xffx00x00' * (width * height) # Red image
with open(filename, 'wb') as f:
f.write(header)
f.write(ifd)
f.write(bps_values)
f.write(res_values)
f.write(data)
def create_palette_tiff(filename, width=8, height=8):
header = b'II' + struct.pack('<HI', 42, 8)
num_entries = 12
entries = []
def add_entry(tag, type, count, value):
entries.append(struct.pack('<HHII', tag, type, count, value))
cmap_offset = 8 + 2 + num_entries*12 + 4
res_offset = cmap_offset + 256 * 3 * 2 # 256 colors, RGB, 2 bytes each
data_offset = res_offset + 16
add_entry(256, 3, 1, width) # Width
add_entry(257, 3, 1, height) # Height
add_entry(258, 3, 1, 8) # BitsPerSample
add_entry(259, 3, 1, 1) # Compression
add_entry(262, 3, 1, 3) # Photometric (Palette)
add_entry(273, 4, 1, data_offset) # StripOffsets
add_entry(277, 3, 1, 1) # SamplesPerPixel
add_entry(278, 3, 1, height) # RowsPerStrip
add_entry(279, 4, 1, width * height) # StripByteCounts
add_entry(282, 5, 1, res_offset) # XRes
add_entry(283, 5, 1, res_offset + 8) # YRes
add_entry(320, 3, 256 * 3, cmap_offset) # ColorMap
ifd = struct.pack('<H', num_entries) + b''.join(entries) + struct.pack('<I',
0)
# Color map: 256 RGB values, each 2 bytes (16-bit)
cmap = b''
for i in range(256): cmap += struct.pack('<H', i * 256) # Red
for i in range(256): cmap += struct.pack('<H', i * 256) # Green
for i in range(256): cmap += struct.pack('<H', i * 256) # Blue
res_values = struct.pack('<IIII', 72, 1, 72, 1)
data = bytes([i % 256 for i in range(width * height)])
with open(filename, 'wb') as f:
f.write(header)
f.write(ifd)
f.write(cmap)
f.write(res_values)
f.write(data)
def main():
corpus_dir = "corpus"
if not os.path.exists(corpus_dir):
os.makedirs(corpus_dir)
base_tiff = os.path.join(corpus_dir, "base_bw.tif")
create_minimal_tiff(base_tiff)
base_gray8 = os.path.join(corpus_dir, "base_gray8.tif")
create_grayscale_tiff(base_gray8, bpp=8)
base_gray16 = os.path.join(corpus_dir, "base_gray16.tif")
create_grayscale_tiff(base_gray16, bpp=16)
base_rgb = os.path.join(corpus_dir, "base_rgb.tif")
create_rgb_tiff(base_rgb)
base_palette = os.path.join(corpus_dir, "base_palette.tif")
create_palette_tiff(base_palette)
bases = [base_tiff, base_gray8, base_gray16, base_rgb, base_palette]
# Use tiffcp to create variations
compressions = ["none", "lzw", "zip", "packbits", "zstd"]
for base in bases:
base_name = os.path.basename(base).split('.')[0]
for comp in compressions:
out = os.path.join(corpus_dir, f"{base_name}_{comp}.tif")
run_cmd(["tiffcp", "-c", comp, base, out])
out_tile = os.path.join(corpus_dir, f"{base_name}_{comp}_tile.tif")
run_cmd(["tiffcp", "-c", comp, "-t", "-w", "8", "-l", "8", base, out
_tile])
# Special compressions for BW
for comp in ["g3", "g4"]:
run_cmd(["tiffcp", "-c", comp, base_tiff, os.path.join(corpus_dir, f"bw_
{comp}.tif")])
# JPEG for RGB
run_cmd(["tiffcp", "-c", "jpeg", base_rgb, os.path.join(corpus_dir, "rgb_jpe
g.tif")])
# BigTIFF
run_cmd(["tiffcp", "-8", base_rgb, os.path.join(corpus_dir, "bigtiff_rgb.tif
")])
# Byte order
run_cmd(["tiffcp", "-B", base_rgb, os.path.join(corpus_dir, "big_endian_rgb.
tif")])
# Planar configuration
run_cmd(["tiffcp", "-p", "separate", base_rgb, os.path.join(corpus_dir, "sep
arate_rgb.tif")])
# Add some tags
tagged_tiff = os.path.join(corpus_dir, "tagged_rgb.tif")
run_cmd(["cp", base_rgb, tagged_tiff])
run_cmd(["tiffset", "-s", "315", "Fuzzer", tagged_tiff])
# Broken cases
# Circular IFD (from base_bw)
circular = os.path.join(corpus_dir, "circular.tif")
with open(base_tiff, 'rb') as f:
data = bytearray(f.read())
# Find next_ifd_offset (last 4 bytes of IFD)
# IFD starts at 8, has 11 entries (11*12=132), + 2 bytes for count = 134.
# next_ifd_offset is at index 142
if len(data) >= 146:
data[142:146] = struct.pack('<I', 8)
with open(circular, 'wb') as f:
f.write(data)
# Huge dimensions
huge_dim = os.path.join(corpus_dir, "huge_dim.tif")
create_minimal_tiff(huge_dim)
run_cmd(["tiffset", "-s", "256", "1000000", huge_dim])
run_cmd(["tiffset", "-s", "257", "1000000", huge_dim])
# Invalid compression tag
invalid_comp = os.path.join(corpus_dir, "invalid_comp.tif")
create_minimal_tiff(invalid_comp)
run_cmd(["tiffset", "-s", "259", "65535", invalid_comp])
print(f"Generated {len(os.listdir(corpus_dir))} samples in {corpus_dir}")
if __name__ == "__main__":
main()
```
除了 AI 生成的这些样本外，`test/images/` 中也有一些样本可以拿来用。
# Fuzzing
编译出来发现有一堆程序，哪个才是我们的目标呢？
查看 Mitre 给出的 references，其中 [Bug 2590 - CVE-2016-9297: segfault in _TIFFP
rintField (tif_print.c:127)](http://bugzilla.maptools.org/show_bug.cgi?id=2590)
写道：
> Triggered in libtiff 4.0.6 with AFL and ASAN. Only crashes if I LD_PRELOAD AFL
's libdislocator (more info: https://github.com/mirrorer/afl/tree/master/libdisl
ocator).
>
> `LD_PRELOAD=/root/afl-2.35b/libdislocator/libdislocator.so ./tiffinfo -i test0
00`
由此可知我们 fuzz 的目标是 `tiffinfo` 。
我们将所有的输出参数都用上，以便提高覆盖率，这里只开了两个线程 fuzz：
```shellsession
mkdir -p /dev/shm/{normal,asan}
AFL_TMPDIR=/dev/shm/asan
afl-fuzz -i corpus
-o outs
-m none
-M asan
-- ../libtiff-fuzz-asan/bin/tiffinfo -Dcjrsw @@
AFL_TMPDIR=/dev/shm/normal
afl-fuzz -i corpus
-o outs
-m none
-S normal
-- ../libtiff-fuzz/bin/tiffinfo -Dcjrsw @@
```
刚跑了两分钟，ASAN 那个线程以每秒一百多 crashes 的速度产出……吓坏了（
# Analysis
## Coverage
这个 chall 主要是让我们使用 [lcov](https://github.com/linux-test-project/lcov)
来生成覆盖率报告的，不过我选择 llvm-cov，而不是 lcov 。
先单独编译一个 cov 插桩的版本：
```shellsession
mkdir ../libtiff-build-cov
cd libtiff-build-cov
CC=clang
CXX=clang++
CFLAGS="-fprofile-instr-generate -fcoverage-mapping"
CXXFLAGS="$CFLAGS"
../libtiff/configure
--prefix="$(realpath ../libtiff-cov)"
--disable-shared
make clean && AFL_USE_ASAN=1 make -j`nproc` && AFL_USE_ASAN=1 make install
```
然后可以使用如下脚本自动生成覆盖率报告：
```python
#!/usr/bin/env python
import os
import subprocess
import glob
import argparse
def run_cmd(cmd, env=None):
"""Run a shell command and return the output."""
try:
result = subprocess.run(cmd, shell=True, env=env, capture_output=True, t
ext=True)
return result.returncode, result.stdout, result.stderr
except Exception as e:
return 1, "", str(e)
def main():
parser = argparse.ArgumentParser(description="Generate llvm-cov report from
AFL++ samples.")
parser.add_argument("--bin", required=True, help="Path to the instrumented b
inary.")
parser.add_argument("--samples", required=True, help="Directory containing A
FL++ samples (e.g., output/default/queue).")
parser.add_argument("--out", default="coverage_report", help="Directory to s
ave the HTML report (default: coverage_report).")
parser.add_argument("--profraw-dir", default="profraws", help="Directory to
store intermediate .profraw files.")
parser.add_argument("--args", default="", help="Additional arguments to pass
to the binary (use {} as placeholder for sample path).")
args = parser.parse_args()
# Create directories
if not os.path.exists(args.profraw_dir):
os.makedirs(args.profraw_dir)
if not os.path.exists(args.out):
os.makedirs(args.out)
# Find all samples
samples = glob.glob(os.path.join(args.samples, "*"))
# Filter only files (AFL++ directories might have subfolders)
samples = [s for s in samples if os.path.isfile(s)]
if not samples:
print(f"No samples found in {args.samples}")
return
print(f"Found {len(samples)} samples. Running coverage...")
# Set up environment for LLVM profile generation
# %p is PID, %m is binary hash to avoid collisions
env = os.environ.copy()
for i, sample in enumerate(samples):
profraw_path = os.path.abspath(os.path.join(args.profraw_dir, f"sample_{
i}.profraw"))
env["LLVM_PROFILE_FILE"] = profraw_path
# Construct command
if "{}" in args.args:
cmd = f"{args.bin} {args.args.format(sample)}"
else:
cmd = f"{args.bin} {args.args} {sample}"
print(f"[{i+1}/{len(samples)}] Running: {cmd}", end="r")
run_cmd(cmd, env=env)
print("nMerging profile data...")
profdata_file = "merged.profdata"
profraw_pattern = os.path.join(args.profraw_dir, "*.profraw")
merge_cmd = f"llvm-profdata merge -sparse {profraw_pattern} -o {profdata_fil
e}"
rc, stdout, stderr = run_cmd(merge_cmd)
if rc != 0:
print(f"Error merging data: {stderr}")
return
print(f"Generating HTML report in {args.out}...")
report_cmd = f"llvm-cov show {args.bin} -instr-profile={profdata_file} -form
at=html -output-dir={args.out}"
rc, stdout, stderr = run_cmd(report_cmd)
if rc != 0:
print(f"Error generating report: {stderr}")
return
# Also generate a summary report
print("nCoverage Summary:")
summary_cmd = f"llvm-cov report {args.bin} -instr-profile={profdata_file}"
rc, stdout, stderr = run_cmd(summary_cmd)
print(stdout)
print(f"Report generated successfully in directory: {args.out}")
print(f"You can view it by opening {os.path.join(args.out, 'index.html')} in
a browser.")
if __name__ == "__main__":
main()
```
```shellsession
./gen_coverage.py --bin ./bin/tiffinfo --args "-Dcjrsw {}" --samples ../libtiff-
workshop/outs/asan/queue
```
最后的 web 报告如下：
出于进度优先的考虑，之后的（包括前面的 libtiff）chall 我都没有深入分析它们的漏洞
成因，想着早点把 fuzz 基本要点都玩明白后去自己写一个结合了 AI 的 fuzzer 。还有一
个原因是 Fuzzing 101 的可复现性不怎么高，能不能跑出和 CVE 描述对应的 crash 完全
是看运气，所以意义不大，没必要浪费时间去磨一个一模一样的 crash 样本。
