From 74bcfc74da1fb51595c4f096e58570453ab4a632 Mon Sep 17 00:00:00 2001
From: Even Rouault <[EMAIL REDACTED]>
Date: Sat, 10 Jun 2023 22:29:23 +0200
Subject: [PATCH] TIFFReadDirectory(): fix crash when reading tag
TIFFTAG_EP_BATTERYLEVEL
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59751
In 738e0409 (refs #575), we disabled DNG / EP tags, but there was a
special proessing for TIFFTAG_EP_BATTERYLEVEL that must be disabled
since the tag is no longer defined.
---
libtiff/tif_dirread.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
index 6595e08f..717cbc84 100644
--- a/libtiff/tif_dirread.c
+++ b/libtiff/tif_dirread.c
@@ -144,10 +144,11 @@ static void TIFFReadDirEntryCheckedFloat(TIFF *tif, TIFFDirEntry *direntry,
float *value);
static enum TIFFReadDirEntryErr
TIFFReadDirEntryCheckedDouble(TIFF *tif, TIFFDirEntry *direntry, double *value);
+#if 0
static enum TIFFReadDirEntryErr
TIFFReadDirEntryCheckedRationalDirect(TIFF *tif, TIFFDirEntry *direntry,
TIFFRational_t *value);
-
+#endif
static enum TIFFReadDirEntryErr
TIFFReadDirEntryCheckRangeByteSbyte(int8_t value);
static enum TIFFReadDirEntryErr
@@ -3472,6 +3473,7 @@ TIFFReadDirEntryCheckedSrational(TIFF *tif, TIFFDirEntry *direntry,
return (TIFFReadDirEntryErrOk);
}
+#if 0
static enum TIFFReadDirEntryErr
TIFFReadDirEntryCheckedRationalDirect(TIFF *tif, TIFFDirEntry *direntry,
TIFFRational_t *value)
@@ -3512,6 +3514,7 @@ TIFFReadDirEntryCheckedRationalDirect(TIFF *tif, TIFFDirEntry *direntry,
value->uDenom = m.i[1];
return (TIFFReadDirEntryErrOk);
} /*-- TIFFReadDirEntryCheckedRationalDirect() --*/
+#endif
static void TIFFReadDirEntryCheckedFloat(TIFF *tif, TIFFDirEntry *direntry,
float *value)
@@ -4569,7 +4572,8 @@ int TIFFReadDirectory(TIFF *tif)
}
}
break;
- /* END REV 4.0 COMPATIBILITY */
+ /* END REV 4.0 COMPATIBILITY */
+#if 0
case TIFFTAG_EP_BATTERYLEVEL:
/* TIFFTAG_EP_BATTERYLEVEL can be RATIONAL or ASCII.
* LibTiff defines it as ASCII and converts RATIONAL to an
@@ -4613,6 +4617,7 @@ int TIFFReadDirectory(TIFF *tif)
break;
}
break;
+#endif
default:
(void)TIFFFetchNormalTag(tif, dp, TRUE);
break;