Skip to content

Commit 5e0e45d

Browse files
committed
PDF: avoid integer division by zero in CreateCopy() when one of dataset dimension is zero
Fixes https://issues.oss-fuzz.com/issues/411459968
1 parent b1f16cf commit 5e0e45d

File tree

2 files changed

+25
-6
lines changed

2 files changed

+25
-6
lines changed

autotest/gdrivers/pdf.py

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3140,3 +3140,15 @@ def test_pdf_gdal_driver_pdf_list_layer():
31403140
alg["input"] = "data/byte.tif"
31413141
with pytest.raises(Exception, match="is not a PDF"):
31423142
alg.Run()
3143+
3144+
3145+
###############################################################################
3146+
#
3147+
3148+
3149+
@gdaltest.enable_exceptions()
3150+
@pytest.mark.require_driver("L1B")
3151+
def test_pdf_create_copy_from_ysize_0(tmp_vsimem):
3152+
src_ds = gdal.Open("../gdrivers/data/l1b/n12gac8bit_truncated_ysize_0_1band.l1b")
3153+
with pytest.raises(Exception, match="nWidth == 0 || nHeight == 0 not supported"):
3154+
gdal.GetDriverByName("PDF").CreateCopy(tmp_vsimem / "out.pdf", src_ds)

frmts/pdf/pdfcreatecopy.cpp

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4150,16 +4150,20 @@ GDALDataset *GDALPDFCreateCopy(const char *pszFilename, GDALDataset *poSrcDS,
41504150
GDALProgressFunc pfnProgress,
41514151
void *pProgressData)
41524152
{
4153-
int nBands = poSrcDS->GetRasterCount();
4154-
int nWidth = poSrcDS->GetRasterXSize();
4155-
int nHeight = poSrcDS->GetRasterYSize();
4156-
4157-
if (!pfnProgress(0.0, nullptr, pProgressData))
4158-
return nullptr;
4153+
const int nBands = poSrcDS->GetRasterCount();
4154+
const int nWidth = poSrcDS->GetRasterXSize();
4155+
const int nHeight = poSrcDS->GetRasterYSize();
41594156

41604157
/* -------------------------------------------------------------------- */
41614158
/* Some some rudimentary checks */
41624159
/* -------------------------------------------------------------------- */
4160+
if (nWidth == 0 || nHeight == 0)
4161+
{
4162+
CPLError(CE_Failure, CPLE_NotSupported,
4163+
"nWidth == 0 || nHeight == 0 not supported");
4164+
return nullptr;
4165+
}
4166+
41634167
if (nBands != 1 && nBands != 3 && nBands != 4)
41644168
{
41654169
CPLError(CE_Failure, CPLE_NotSupported,
@@ -4491,6 +4495,9 @@ GDALDataset *GDALPDFCreateCopy(const char *pszFilename, GDALDataset *poSrcDS,
44914495
const char *pszJavascriptFile =
44924496
CSLFetchNameValue(papszOptions, "JAVASCRIPT_FILE");
44934497

4498+
if (!pfnProgress(0.0, nullptr, pProgressData))
4499+
return nullptr;
4500+
44944501
/* -------------------------------------------------------------------- */
44954502
/* Create file. */
44964503
/* -------------------------------------------------------------------- */

0 commit comments

Comments
 (0)