diff options
| author | Sebastian Rasmussen <sebras@gmail.com> | 2016-09-27 16:46:41 +0800 |
|---|---|---|
| committer | Sebastian Rasmussen <sebras@gmail.com> | 2016-09-28 00:10:39 +0800 |
| commit | e07b6fdd72d638840c077a8b53226a6aefd7d9ec (patch) | |
| tree | e2cc12b4146cd55dbc050b08a544124cd1c9938e /source | |
| parent | 3f4746d038041e0bc368fa99b3669d8230961620 (diff) | |
| download | mupdf-e07b6fdd72d638840c077a8b53226a6aefd7d9ec.tar.xz | |
Bug 697157: tiff: Rational tag denominators may not be zero.
Diffstat (limited to 'source')
| -rw-r--r-- | source/fitz/load-tiff.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/source/fitz/load-tiff.c b/source/fitz/load-tiff.c index cfa8e2e2..9e37cc6f 100644 --- a/source/fitz/load-tiff.c +++ b/source/fitz/load-tiff.c @@ -619,6 +619,8 @@ fz_read_tiff_bytes(unsigned char *p, struct tiff *tiff, unsigned ofs, unsigned n static void fz_read_tiff_tag_value(unsigned *p, struct tiff *tiff, unsigned type, unsigned ofs, unsigned n) { + unsigned den; + tiff->rp = tiff->bp + ofs; if (tiff->rp > tiff->ep) tiff->rp = tiff->bp; @@ -629,7 +631,11 @@ fz_read_tiff_tag_value(unsigned *p, struct tiff *tiff, unsigned type, unsigned o { case TRATIONAL: *p = readlong(tiff); - *p = *p / readlong(tiff); + den = readlong(tiff); + if (den) + *p = *p / den; + else + *p = UINT_MAX; p ++; break; case TBYTE: *p++ = readbyte(tiff); break; |