Merge pull request #1831 from kevinbackhouse/FixIssue1830

Safer casting from double to long in value.hpp
Exiv2 · Aug 3, 2021 · 2cf0159 · 2cf0159
2 parents 9ccd5cb + 372e28c
commit 2cf0159
Show file tree

Hide file tree

Showing 3 changed files with 35 additions and 0 deletions.
diff --git a/include/exiv2/value.hpp b/include/exiv2/value.hpp
@@ -1640,6 +1640,24 @@ namespace Exiv2 {
     }
 // #55 crash when value_.at(n).first == LONG_MIN
 #define LARGE_INT 1000000
+    // Specialization for double
+    template<>
+    inline long ValueType<double>::toLong(long n) const
+    {
+        const double v = value_.at(n);
+        ok_ = (INT_MIN <= v && v <= INT_MAX);
+        if (!ok_) return 0;
+        return static_cast<long>(v);
+    }
+    // Specialization for float
+    template<>
+    inline long ValueType<float>::toLong(long n) const
+    {
+        const double v = value_.at(n);
+        ok_ = (INT_MIN <= v && v <= INT_MAX);
+        if (!ok_) return 0;
+        return static_cast<long>(v);
+    }
     // Specialization for rational
     template<>
     inline long ValueType<Rational>::toLong(long n) const

diff --git a/test/data/issue_1830_poc.tiff b/test/data/issue_1830_poc.tiff
diff --git a/tests/bugfixes/github/test_issue_1830.py b/tests/bugfixes/github/test_issue_1830.py
@@ -0,0 +1,17 @@
+# -*- coding: utf-8 -*-
+
+from system_tests import CaseMeta, CopyTmpFiles, path, check_no_ASAN_UBSAN_errors
+
+class ValueTypeFloatToLong(metaclass=CaseMeta):
+    """
+    Regression test for the bug described in:
+    https://github.com/Exiv2/exiv2/issues/1830
+    """
+    url = "https://github.com/Exiv2/exiv2/issues/1830"
+
+    filename = path("$data_path/issue_1830_poc.tiff")
+    commands = ["$exiv2 -q $filename"]
+    stderr = [""]
+    retval = [0]
+
+    compare_stdout = check_no_ASAN_UBSAN_errors