PDF: avoid division by zero when generating from vector content whose…

… bounding box is almost a horizontal or vertical line. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13408. Credit to OSS Fuzz
OSGeo · Feb 26, 2019 · afbb4e3 · afbb4e3
1 parent ea4800d
commit afbb4e3
Showing 1 changed file with 14 additions and 2 deletions.
diff --git a/gdal/frmts/pdf/pdfwritabledataset.cpp b/gdal/frmts/pdf/pdfwritabledataset.cpp
@@ -268,12 +268,24 @@ OGRErr PDFWritableVectorDataset::SyncToDisk()
     if (dfRatio < 1)
     {
         nWidth = 1024;
-        nHeight = static_cast<int>(nWidth * dfRatio);
+        const double dfHeight = nWidth * dfRatio;
+        if( dfHeight < 1 || dfHeight > INT_MAX || CPLIsNan(dfHeight) )
+        {
+            CPLError(CE_Failure, CPLE_AppDefined, "Invalid image dimensions");
+            return OGRERR_FAILURE;
+        }
+        nHeight = static_cast<int>(dfHeight);
     }
     else
     {
         nHeight = 1024;
-        nWidth = static_cast<int>(nHeight / dfRatio);
+        const double dfWidth = nHeight / dfRatio;
+        if( dfWidth < 1 || dfWidth > INT_MAX || CPLIsNan(dfWidth) )
+        {
+            CPLError(CE_Failure, CPLE_AppDefined, "Invalid image dimensions");
+            return OGRERR_FAILURE;
+        }
+        nWidth = static_cast<int>(dfWidth);
     }
 
     GDALDataset* poSrcDS = MEMDataset::Create( "MEM:::", nWidth, nHeight, 0, GDT_Byte, nullptr );