Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

float_to_integer_helper doesn't handle fractions correctly #2160

Closed
kevinbackhouse opened this issue Mar 19, 2022 · 0 comments · Fixed by #2161
Closed

float_to_integer_helper doesn't handle fractions correctly #2160

kevinbackhouse opened this issue Mar 19, 2022 · 0 comments · Fixed by #2161
Assignees
Labels
bug OSS-Fuzz Bug reported by https://google.github.io/oss-fuzz/
Milestone

Comments

@kevinbackhouse
Copy link
Collaborator

Found by OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45291

OSS-Fuzz has reported this as an integer overflow in sumToLong. The actual problem is in float_to_integer_helper:

exiv2/include/exiv2/value.hpp

Lines 1248 to 1258 in 5d5354e

//! Utility for toInt64, toUint32, etc.
template <typename I>
inline I float_to_integer_helper(size_t n) const {
const auto v = value_.at(n);
if (static_cast<decltype(v)>(std::numeric_limits<I>::min()) <= v &&
v <= static_cast<decltype(v)>(std::numeric_limits<I>::max())) {
return static_cast<I>(v);
} else {
return 0;
}
}

It seems that the static_cast<I>(v) produces garbage when v is a fraction. In the poc, v == 6.0134700169990685e-154.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug OSS-Fuzz Bug reported by https://google.github.io/oss-fuzz/
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant