diff options
| author | erouault <erouault> | 2017-01-11 13:28:01 +0000 |
|---|---|---|
| committer | erouault <erouault> | 2017-01-11 13:28:01 +0000 |
| commit | 69d365ead4770b6929f08e5b0b0ba797a0f6ac20 (patch) | |
| tree | 5d7f58c93474b5fc70ec8bc4ca5d546c5f98eaee | |
| parent | 04d8710a1050da773aeba686912baede89623ff3 (diff) | |
| download | libtiff-69d365ead4770b6929f08e5b0b0ba797a0f6ac20.tar.gz | |
* libtiff/tif_dirread.c: avoid division by floating point 0 in
TIFFReadDirEntryCheckedRational() and TIFFReadDirEntryCheckedSrational(),
and return 0 in that case (instead of infinity as before presumably)
Apparently some sanitizers do not like those divisions by zero.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2644
| -rw-r--r-- | ChangeLog | 8 | ||||
| -rw-r--r-- | libtiff/tif_dirread.c | 12 |
2 files changed, 17 insertions, 3 deletions
@@ -1,5 +1,13 @@ 2017-01-11 Even Rouault <even.rouault at spatialys.com> + * libtiff/tif_dirread.c: avoid division by floating point 0 in + TIFFReadDirEntryCheckedRational() and TIFFReadDirEntryCheckedSrational(), + and return 0 in that case (instead of infinity as before presumably) + Apparently some sanitizers do not like those divisions by zero. + Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2644 + +2017-01-11 Even Rouault <even.rouault at spatialys.com> + * libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedRational, replace assertion by runtime check to error out if passed value is strictly negative. diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c index f2905286..eae34306 100644 --- a/libtiff/tif_dirread.c +++ b/libtiff/tif_dirread.c @@ -1,4 +1,4 @@ -/* $Id: tif_dirread.c,v 1.205 2016-12-03 11:02:15 erouault Exp $ */ +/* $Id: tif_dirread.c,v 1.206 2017-01-11 13:28:01 erouault Exp $ */ /* * Copyright (c) 1988-1997 Sam Leffler @@ -2872,7 +2872,10 @@ static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedRational(TIFF* tif, TIFFD m.l = direntry->tdir_offset.toff_long8; if (tif->tif_flags&TIFF_SWAB) TIFFSwabArrayOfLong(m.i,2); - if (m.i[0]==0) + /* Not completely sure what we should do when m.i[1]==0, but some */ + /* sanitizers do not like division by 0.0: */ + /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */ + if (m.i[0]==0 || m.i[1]==0) *value=0.0; else *value=(double)m.i[0]/(double)m.i[1]; @@ -2900,7 +2903,10 @@ static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSrational(TIFF* tif, TIFF m.l=direntry->tdir_offset.toff_long8; if (tif->tif_flags&TIFF_SWAB) TIFFSwabArrayOfLong(m.i,2); - if ((int32)m.i[0]==0) + /* Not completely sure what we should do when m.i[1]==0, but some */ + /* sanitizers do not like division by 0.0: */ + /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */ + if ((int32)m.i[0]==0 || m.i[1]==0) *value=0.0; else *value=(double)((int32)m.i[0])/(double)m.i[1]; |