# Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)

PHP exif_read_data on crafted TIFF with out-of-bounds thumbnail offset returns uninitialized heap memory, leaking pointers to defeat ASLR/PIE.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: hoangnguyen
- Disclosed: 2019-11-12
- CVE: CVE-2016-7128
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/160294
- Library page: https://bugbountylibrary.com/r/h1%3A160294
- Tags: area:oss domain:oss impact:data-leak kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:info-disclosure vuln:memory-corruption

**Target:** PHP exif extension, exif_process_IFD_in_TIFF / exif_thumbnail_build
**Root cause:** Thumbnail offset is not validated against file size; php_stream_read returns 0 but EXIF_ERRLOG_THUMBEOF only logs a warning without aborting, so exif_thumbnail_build proceeds on an uninitialized safe_emalloc buffer.
**Steps:**
1. Craft a TIFF with JPEGInterchangeFormat (thumbnail offset) larger than file size and JPEGInterchangeFormatLength set (e.g. 200)
2. Call `exif_read_data('gen.tiff',0,0,true)` in PHP
3. php_stream_read returns 0, warning logged, no exit
4. exif_thumbnail_build returns early for JPEG type, leaving Thumbnail.data uninitialized
5. Dump `$exif['THUMBNAIL']['THUMBNAIL']` via bin2hex to read leaked heap bytes
**How found:** Code review of exif_process_IFD_in_TIFF noticed the missing offset-vs-filesize check and that EXIF_ERRLOG_THUMBEOF is a non-fatal warning macro with no exit, so execution continues into exif_thumbnail_build on an unfilled buffer.
**Exploitation:** Attacker supplies crafted TIFF to any PHP app calling exif_read_data; leaked uninitialized heap bytes (e.g. 0x7f1e08a7c200 pointer) disclose memory addresses usable to bypass ASLR/PIE in a chained exploit.
**Insight:** Error-logging macros that only emit E_WARNING without returning/aborting leave code paths executing on uninitialized buffers; audit every EXIF_ERRLOG_* call site for missing early return, especially where safe_emalloc output is later returned to userspace.