Safer casting from double to long in value.hpp (backport #1831)

include/exiv2/value.hpp

@@ -1628,6 +1628,24 @@ namespace Exiv2 {
     }
 // #55 crash when value_.at(n).first == LONG_MIN
 #define LARGE_INT 1000000
+    // Specialization for double
+    template<>
+    inline long ValueType<double>::toLong(long n) const
+    {
+        const double v = value_.at(n);
+        ok_ = (INT_MIN <= v && v <= INT_MAX);
+        if (!ok_) return 0;
+        return static_cast<long>(v);
+    }
+    // Specialization for float
+    template<>
+    inline long ValueType<float>::toLong(long n) const
+    {
+        const double v = value_.at(n);
+        ok_ = (INT_MIN <= v && v <= INT_MAX);
+        if (!ok_) return 0;
+        return static_cast<long>(v);
+    }
     // Specialization for rational
     template<>
     inline long ValueType<Rational>::toLong(long n) const

tests/bugfixes/github/test_issue_1830.py

@@ -0,0 +1,17 @@
+# -*- coding: utf-8 -*-
+
+from system_tests import CaseMeta, CopyTmpFiles, path, check_no_ASAN_UBSAN_errors
+
+class ValueTypeFloatToLong(metaclass=CaseMeta):
+    """
+    Regression test for the bug described in:
+    https://github.com/Exiv2/exiv2/issues/1830
+    """
+    url = "https://github.com/Exiv2/exiv2/issues/1830"
+
+    filename = path("$data_path/issue_1830_poc.tiff")
+    commands = ["$exiv2 -q $filename"]
+    stderr = [""]
+    retval = [0]
+
+    compare_stdout = check_no_ASAN_UBSAN_errors