Skip to content

Conversation

@kevinbackhouse
Copy link
Collaborator

The main change here is to fix an integer divide by zero in src/minoltamn_int.cpp.

I also added some defensive coding to avoid the FPE that could be caused by 0x80000000/0xFFFFFFFF: rather than checking that the denominator is not zero, check that the denominator is greater than zero. I doubt that we are ever deliberately using negative denominators, so I think it should be a safe change.

@kevinbackhouse kevinbackhouse added the forward-to-main Forward changes in a 0.28.x PR to main with Mergify label Jun 30, 2021
@kevinbackhouse
Copy link
Collaborator Author

This is the CodeQL query that I used to search for integer divide operations:

import cpp
import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis

from DivExpr div, Expr rhs
where
  rhs = div.getRightOperand() and
  div.getType() instanceof IntegralType and
  not (lowerBound(rhs) > 0 or upperBound(rhs) < 0) and
  not rhs instanceof SizeofOperator and
  exists(rhs.getLocation().getFile().getRelativePath())
select rhs, rhs.getType()

Copy link
Member

@hassec hassec left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 great stuff!

@hassec hassec merged commit cdec9dd into Exiv2:0.27-maintenance Jun 30, 2021
@hassec hassec added this to the v0.27.5 milestone Jun 30, 2021
@hassec hassec added the bug label Jun 30, 2021
@clanmills clanmills mentioned this pull request Aug 9, 2021
@kevinbackhouse kevinbackhouse deleted the Fix-GHSA-pvjp-m4f6-q984 branch August 11, 2021 15:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug forward-to-main Forward changes in a 0.28.x PR to main with Mergify

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants