# Uninitialized Thumbail Data Leads To Memory Leakage in exif_process_IFD_in_TIFF

PHP exif_process_IFD_in_TIFF reads thumbnail data without validating Thumbnail.offset against file size, leaking uninitialized heap memory via crafted TIFF.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: hoangnguyen
- Disclosed: 2019-11-12
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/167888
- Library page: https://bugbountylibrary.com/r/h1%3A167888
- Tags: area:oss domain:oss impact:data-leak kind:bounty platform:hackerone sev:medium tech:php technique:incomplete-fix technique:source-review vuln:info-disclosure vuln:memory-corruption

**Target:** PHP exif extension TIFF parser (exif_process_IFD_in_TIFF)
**Root cause:** When processing TAG_SUB_IFD, the code allocates Thumbnail.size bytes and reads from Thumbnail.offset without checking offset against FileSize; a short read only logs EXIF_ERRLOG_THUMBEOF (no exit), leaving the buffer partially uninitialized and later exposed.
**Steps:**
1. Craft a TIFF with a SUB_IFD entry whose Thumbnail.offset exceeds the file size and Thumbnail.size is nonzero.
2. Trigger exif_read_data on the file so exif_process_IFD_in_TIFF processes the SUB_IFD tag.
3. safe_emalloc allocates Thumbnail.size bytes; php_stream_seek to the out-of-range offset; php_stream_read returns 0 (fgot < size).
4. EXIF_ERRLOG_THUMBEOF only emits a warning and does not abort, so exif_thumbnail_build processes the uninitialized buffer.
5. Read back the thumbnail to leak uninitialized heap contents.
**How found:** Researcher reviewed the SUB_IFD handling branch and noticed Thumbnail.offset was never validated against FileSize, and that the THUMBEOF error macro lacks an exit, mirroring a previously reported bug (72627).
**Exploitation:** Attacker supplies a malicious TIFF to a PHP app calling exif_read_data/exif_thumbnail; the out-of-range thumbnail offset causes a short read leaving heap memory uninitialized, which is then returned as thumbnail data, disclosing prior heap contents.
**Insight:** When a read-error macro only logs a warning, check whether the caller continues to use the partially-filled buffer; short reads on attacker-controlled offsets are a reliable uninitialized-memory leak primitive.