diff --git a/src/decoder/mod.rs b/src/decoder/mod.rs index 368d8fc..f7b3665 100644 --- a/src/decoder/mod.rs +++ b/src/decoder/mod.rs @@ -1277,7 +1277,13 @@ impl Decoder { return Ok(0); } - Ok((self.height + rows_per_strip - 1) / rows_per_strip) + // rows_per_strip - 1 can never fail since we know it's at least 1 + let height = match self.height.checked_add(rows_per_strip - 1) { + Some(h) => h, + None => return Err(TiffError::IntSizeError), + }; + + Ok(height / rows_per_strip) } /// Number of tiles in image diff --git a/tests/decode_images.rs b/tests/decode_images.rs index bf23a2a..0f2ba80 100644 --- a/tests/decode_images.rs +++ b/tests/decode_images.rs @@ -325,3 +325,23 @@ fn test_too_many_value_bytes() { unexpected => panic!("Unexpected error {}", unexpected), } } + +#[test] +fn test_bad_strip_count() { + let image = [ + 73, 73, 42, 0, 8, 0, 0, 0, 8, 0, 0, 1, 4, 0, 1, 0, 0, 0, 100, 0, 0, 0, 1, 1, 4, 0, 1, 0, 0, + 0, 158, 0, 0, 251, 3, 1, 3, 0, 1, 0, 0, 0, 1, 0, 0, 0, 6, 1, 3, 0, 1, 0, 0, 0, 0, 0, 0, 0, + 17, 1, 4, 0, 1, 0, 0, 0, 0, 0, 0, 0, 2, 1, 3, 0, 0, 0, 0, 0, 246, 16, 0, 0, 22, 1, 4, 0, 1, + 0, 0, 0, 40, 0, 251, 255, 23, 1, 4, 0, 1, 0, 0, 0, 48, 178, 178, 178, 178, 178, 178, 178, + 178, 178, 178, + ]; + + let mut decoder = tiff::decoder::Decoder::new(std::io::Cursor::new(&image)).unwrap(); + + let err = decoder.read_image().unwrap_err(); + + match err { + tiff::TiffError::IntSizeError => {} + unexpected => panic!("Unexpected error {}", unexpected), + } +}