From eda5a8ac30e02152bb3c4f9447c5753a1a282207 Mon Sep 17 00:00:00 2001
From: 5225225 <5225225@mailbox.org>
Date: Fri, 28 May 2021 14:44:50 +0100
Subject: [PATCH 1/2] Fix division by zero issue with malformed file

---
 src/decoder/mod.rs     |  8 ++++++++
 tests/decode_images.rs | 15 +++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/src/decoder/mod.rs b/src/decoder/mod.rs
index 173c4d5..368d8fc 100644
--- a/src/decoder/mod.rs
+++ b/src/decoder/mod.rs
@@ -1309,6 +1309,14 @@ impl<R: Read + Seek> Decoder<R> {
             let tile_width = usize::try_from(self.get_tag_u32(Tag::TileWidth)?)?;
             let tile_length = usize::try_from(self.get_tag_u32(Tag::TileLength)?)?;
 
+            if tile_width == 0 {
+                return Err(TiffFormatError::InvalidTagValueType(Tag::TileWidth).into());
+            }
+
+            if tile_length == 0 {
+                return Err(TiffFormatError::InvalidTagValueType(Tag::TileLength).into());
+            }
+
             let tiles_across = (usize::try_from(self.width)? + tile_width - 1) / tile_width;
             let tiles_down = (usize::try_from(self.height)? + tile_length - 1) / tile_length;
 
diff --git a/tests/decode_images.rs b/tests/decode_images.rs
index 863b23f..42df671 100644
--- a/tests/decode_images.rs
+++ b/tests/decode_images.rs
@@ -284,3 +284,18 @@ fn test_tiled_incremental() {
         }
     }
 }
+
+#[test]
+fn test_div_zero() {
+    let image = [
+        73, 73, 42, 0, 8, 0, 0, 0, 8, 0, 0, 1, 4, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 40, 1, 0, 0,
+        0, 158, 0, 0, 251, 3, 1, 3, 0, 1, 0, 0, 0, 1, 0, 0, 39, 6, 1, 3, 0, 1, 0, 0, 0, 0, 0, 0, 0,
+        17, 1, 4, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 1, 3, 0, 1, 0, 0, 0, 158, 0, 0, 251, 67, 1, 3, 0,
+        1, 0, 0, 0, 40, 0, 0, 0, 66, 1, 4, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 48, 178, 178, 178, 178,
+        178, 178, 178,
+    ];
+
+    let mut decoder = tiff::decoder::Decoder::new(std::io::Cursor::new(&image)).unwrap();
+
+    let _ = decoder.read_image();
+}

From bdfe2f55fd97cbb4e64b7591783137a2e9245b96 Mon Sep 17 00:00:00 2001
From: 5225225 <5225225@mailbox.org>
Date: Fri, 28 May 2021 15:46:55 +0100
Subject: [PATCH 2/2] Check error returned from parsing invalid image

---
 tests/decode_images.rs | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/tests/decode_images.rs b/tests/decode_images.rs
index 42df671..58ffc4a 100644
--- a/tests/decode_images.rs
+++ b/tests/decode_images.rs
@@ -287,6 +287,9 @@ fn test_tiled_incremental() {
 
 #[test]
 fn test_div_zero() {
+    use tiff::tags;
+    use tiff::{TiffError, TiffFormatError};
+
     let image = [
         73, 73, 42, 0, 8, 0, 0, 0, 8, 0, 0, 1, 4, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 40, 1, 0, 0,
         0, 158, 0, 0, 251, 3, 1, 3, 0, 1, 0, 0, 0, 1, 0, 0, 39, 6, 1, 3, 0, 1, 0, 0, 0, 0, 0, 0, 0,
@@ -297,5 +300,10 @@ fn test_div_zero() {
 
     let mut decoder = tiff::decoder::Decoder::new(std::io::Cursor::new(&image)).unwrap();
 
-    let _ = decoder.read_image();
+    let err = decoder.read_image().unwrap_err();
+
+    match err {
+        TiffError::FormatError(TiffFormatError::InvalidTagValueType(tags::Tag::TileWidth)) => {}
+        unexpected => panic!("Unexpected error {}", unexpected),
+    }
 }