diff --git a/src/decoder/mod.rs b/src/decoder/mod.rs index 173c4d5..368d8fc 100644 --- a/src/decoder/mod.rs +++ b/src/decoder/mod.rs @@ -1309,6 +1309,14 @@ impl Decoder { let tile_width = usize::try_from(self.get_tag_u32(Tag::TileWidth)?)?; let tile_length = usize::try_from(self.get_tag_u32(Tag::TileLength)?)?; + if tile_width == 0 { + return Err(TiffFormatError::InvalidTagValueType(Tag::TileWidth).into()); + } + + if tile_length == 0 { + return Err(TiffFormatError::InvalidTagValueType(Tag::TileLength).into()); + } + let tiles_across = (usize::try_from(self.width)? + tile_width - 1) / tile_width; let tiles_down = (usize::try_from(self.height)? + tile_length - 1) / tile_length; diff --git a/tests/decode_images.rs b/tests/decode_images.rs index 863b23f..42df671 100644 --- a/tests/decode_images.rs +++ b/tests/decode_images.rs @@ -284,3 +284,18 @@ fn test_tiled_incremental() { } } } + +#[test] +fn test_div_zero() { + let image = [ + 73, 73, 42, 0, 8, 0, 0, 0, 8, 0, 0, 1, 4, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 40, 1, 0, 0, + 0, 158, 0, 0, 251, 3, 1, 3, 0, 1, 0, 0, 0, 1, 0, 0, 39, 6, 1, 3, 0, 1, 0, 0, 0, 0, 0, 0, 0, + 17, 1, 4, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 1, 3, 0, 1, 0, 0, 0, 158, 0, 0, 251, 67, 1, 3, 0, + 1, 0, 0, 0, 40, 0, 0, 0, 66, 1, 4, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 48, 178, 178, 178, 178, + 178, 178, 178, + ]; + + let mut decoder = tiff::decoder::Decoder::new(std::io::Cursor::new(&image)).unwrap(); + + let _ = decoder.read_image(); +}