34 lines
1.0 KiB
Diff
34 lines
1.0 KiB
Diff
From e56d66a033b533f26872a20cb2052473962a0f2e Mon Sep 17 00:00:00 2001
|
|
From: 4ugustus <wangdw.augustus@qq.com>
|
|
Date: Tue, 8 Mar 2022 16:22:04 +0000
|
|
Subject: [PATCH] fix the FPE in tiffcrop (#393)
|
|
|
|
CVE: CVE-2022-0909
|
|
Upstream-Status: Backport
|
|
Signed-off-by: Ross Burton <ross.burton@arm.com>
|
|
|
|
---
|
|
libtiff/tif_dir.c | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c
|
|
index a6c254f..77da6ea 100644
|
|
--- a/libtiff/tif_dir.c
|
|
+++ b/libtiff/tif_dir.c
|
|
@@ -335,13 +335,13 @@ _TIFFVSetField(TIFF* tif, uint32_t tag, va_list ap)
|
|
break;
|
|
case TIFFTAG_XRESOLUTION:
|
|
dblval = va_arg(ap, double);
|
|
- if( dblval < 0 )
|
|
+ if( dblval != dblval || dblval < 0 )
|
|
goto badvaluedouble;
|
|
td->td_xresolution = _TIFFClampDoubleToFloat( dblval );
|
|
break;
|
|
case TIFFTAG_YRESOLUTION:
|
|
dblval = va_arg(ap, double);
|
|
- if( dblval < 0 )
|
|
+ if( dblval != dblval || dblval < 0 )
|
|
goto badvaluedouble;
|
|
td->td_yresolution = _TIFFClampDoubleToFloat( dblval );
|
|
break;
|