Stack Buffer Overflow in libtiff tiffcrop readSeparateStripsIntoBuffer

Thinking Process: 1. Analyze the Request: Task: Translate a Chinese vulnerability intelligence summary to English. Role: Professional translator specializing in cybersecurity. Constraint 1: Maintain all Markdown formatting intact. Constraint 2: Do not add any introductory or concluding remarks. Input: A Markdown-formatted text containing vulnerability details (Description, Version, Fix Status, Reproduction, Participants). 2. Analyze the Input Text: Header: (Vulnerability Key Information / Critical Vulnerability Information) Section 1: (Vulnerability Description) : Stack-based buffer overflow (基于栈的缓冲区溢出) : tiffcrop (part of libtiff) (tiffcrop（libtiff 的一部分）) : readSeparateStripsIntoBuffer : When processing corrupted TIFF directories (e.g., improper tags/order, missing StripByteCounts) (处理损坏的 TIFF 目录时（例如，不当的标签/顺序，缺少 StripByteCounts）) : The function causes a buffer overflow by accessing an element outside the bounds of a stack-allocated array (srcbufs) in combineSeparateSamplesBytes. This triggers a buffer read out-of-bounds and crash detected by AddressSanitizer. (该函数通过在 combineSeparateSamplesBytes 中访问堆栈分配数组（srcbufs）的边界之外的一个元素，导致缓冲区溢出。这会引发 AddressSanitizer 检测到的缓冲区读取越界和崩溃。) Section 2: (Version) : Latest version of libtiff (libtiff 的最新版本) Section 3: (Fix Status) : Closed (已关闭) : Fix buffer overflow in tiffcrop #740 !757 (merged) (修复 tiffcrop 中的缓冲区溢出 #740 !757（已合并）) Section 4: (Vulnerability Reproduction) Code block with bash commands and output logs. Needs to remain exactly as is (mostly), but ensure any Chinese text within the log (if any) is handled. Looking closely, the log content seems to be English already (e.g., ). Wait, the command line has paths like . The log output is English. I should keep the code block content exactly as is because it's technical output, but the header needs translation. Section 5: (Participants) 3. Drafting the Translation: -> (or , . "Key Information" is literal, "Details" is common. Let's stick close to the meaning: or . In security contexts, is often used, but is accurate. Let's use to be safe, or . Actually, "关键信息" often translates to "Key Information" or "Critical Information". Let's go with .) -> -> -> -> -> -> -> -> -> -> -> -> Code block: Keep as is. It contains English logs mostly. -> -> 4. Refining Terminology: "基于栈的缓冲区溢出" -> "Stack-based buffer overflow" (Standard term). "损坏的 TIFF 目录" -> "Corrupted TIFF directory" or "Malformed TIFF directory". "Corrupted" is fine based on context. "堆栈分配数组" -> "stack-allocated array". "边界之外" -> "outside the bounds". "读取越界" -> "read out-of-bounds". "已关闭" -> "Closed" (Common in issue trackers). "已合并" -> "merged". 5. Final Review against Constraints: Markdown intact? Yes. No intro/outro? Yes. Professional cybersecurity tone? Yes. 6. Constructing Output: (Mental check of the code block) The code block contains and log output. The log output is already in English in the source text provided (e.g., ). I should not translate the log output inside the code block as it represents raw system output. I will keep the code block content exactly as provided in the source to maintain fidelity to the reproduction steps. Wait, checking the source text again: This is already English. I will preserve it exactly. One small detail: -> or ? The section title is just "Version", but the content is "Affected Version". I will translate the header as to match the source structure, or for clarity. Usually, in these reports, implies affected version. Let's stick to to be faithful to the header, or if it sounds better. Given "受影响版本" is inside, is sufficient. Let's use . Actually, looking at standard CVE/advisory formats: -> -> -> -> -> -> Let's assemble. One check on "Ghost User @ghost1". This is likely a username. Keep as is. One check on "libtiff 的最新版本". "Latest version of libtiff". One check on "已关闭". "Closed". One check on "相关提交". "Related Commits" or "Related Submission". "Related Commits" is standard for Git. One check on "具体问题". "Specific Issue" or "Detailed Description". "Specific Issue" fits well. Let's finalize the translation. -> -> -> -> -> -> -> -> -> -> -> -> -> -> Looks good. Wait, I need to make sure I don't translate the content inside the code block if it's already English. The source text provided has English inside the code block. I will keep it exactly as is. Wait, one detail in the source text: . This looks like a truncated path or specific test case. I will keep it exactly. Ready to generate. Wait, re-reading "漏洞关键信息". Sometimes "Key Information" sounds a bit Chinglish. "Critical Information" or "Summary" might be better. However, "Key Information" is a direct translation. In security advisories, "Vulnerability Details" is common. But I should translate faithfully. "Vulnerability Key Information" is acceptable. Let's use . Actually, might be more natural, but is safer for fidelity. I'll stick with . Wait, . In context, it refers to affected versions. might be clearer, but is the literal translation. I will use to match the header style, but th

Goal Reached Thanks to every supporter — we hit 100%!

Stack Buffer Overflow in libtiff tiffcrop readSeparateStripsIntoBuffer