| Andrew Geissler | 9aee500 | 2022-03-30 16:27:02 +0000 | [diff] [blame^] | 1 | CVE: CVE-2022-0909 |
| 2 | Upstream-Status: Backport |
| 3 | Signed-off-by: Ross Burton <ross.burton@arm.com> |
| 4 | |
| 5 | From 4768355a074d562177e0a8b551c561d1af7eb74a Mon Sep 17 00:00:00 2001 |
| 6 | From: 4ugustus <wangdw.augustus@qq.com> |
| 7 | Date: Tue, 8 Mar 2022 16:22:04 +0000 |
| 8 | Subject: [PATCH 5/6] fix the FPE in tiffcrop (#393) |
| 9 | |
| 10 | --- |
| 11 | libtiff/tif_dir.c | 4 ++-- |
| 12 | 1 file changed, 2 insertions(+), 2 deletions(-) |
| 13 | |
| 14 | diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c |
| 15 | index a6c254fc..77da6ea4 100644 |
| 16 | --- a/libtiff/tif_dir.c |
| 17 | +++ b/libtiff/tif_dir.c |
| 18 | @@ -335,13 +335,13 @@ _TIFFVSetField(TIFF* tif, uint32_t tag, va_list ap) |
| 19 | break; |
| 20 | case TIFFTAG_XRESOLUTION: |
| 21 | dblval = va_arg(ap, double); |
| 22 | - if( dblval < 0 ) |
| 23 | + if( dblval != dblval || dblval < 0 ) |
| 24 | goto badvaluedouble; |
| 25 | td->td_xresolution = _TIFFClampDoubleToFloat( dblval ); |
| 26 | break; |
| 27 | case TIFFTAG_YRESOLUTION: |
| 28 | dblval = va_arg(ap, double); |
| 29 | - if( dblval < 0 ) |
| 30 | + if( dblval != dblval || dblval < 0 ) |
| 31 | goto badvaluedouble; |
| 32 | td->td_yresolution = _TIFFClampDoubleToFloat( dblval ); |
| 33 | break; |
| 34 | -- |
| 35 | 2.25.1 |
| 36 | |