Fix TIFF divide by zero (bug report from Donghai Zhu)

diff --git a/ChangeLog b/ChangeLog
index 12c8c95f0f94e72dc1a40d8b394d64895f0cad21..56e92f92e6aa525d2ae209276b3ba55fc98ef202 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,8 +1,8 @@
 2016-08-15  7.0.2-10 Cristy  <quetzlzacatenango@image...>
   * Prevent buffer overflow in BMP & SGI coders (bug report from
     pwchen&rayzhong of tencent).
-  * Prevent buffer overflow in SIXEL, PDB, MAP, and CALS coders (bug report
-    from Donghai Zhu).
+  * Prevent buffer overflow and other problems in SIXEL, PDB, MAP, TIFF and
+    CALS coders (bug report from Donghai Zhu).
 
 2016-08-14  7.0.2-9 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.2-9, GIT revision 18707:2c02f09:20160814.

diff --git a/coders/tiff.c b/coders/tiff.c
index 32ed204270f8de62ad0b06532140a929ddc22b71..4d0334b6259c70944d9ebf7af47a6f4e75a6c702 100644 (file)
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -3479,7 +3479,9 @@ static MagickBooleanType WriteTIFFImage(const ImageInfo *image_info,
       if ((image_info->interlace == PlaneInterlace) ||
           (image_info->interlace == PartitionInterlace))
         (void) TIFFSetField(tiff,TIFFTAG_PLANARCONFIG,PLANARCONFIG_SEPARATE);
-     rows_per_strip=TIFFDefaultStripSize(tiff,0);
+    rows_per_strip=1;
+    if (TIFFScanlineSize(tiff) != 0)
+      rows_per_strip=TIFFDefaultStripSize(tiff,0);
     option=GetImageOption(image_info,"tiff:rows-per-strip");
     if (option != (const char *) NULL)
       rows_per_strip=(size_t) strtol(option,(char **) NULL,10);