https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9370

diff --git a/coders/tiff.c b/coders/tiff.c
index 2d52addc0ded72eb842a173b538ac0575d151847..2a042cbb5aae1356826ac7dbd62b2d1d9e446486 100644 (file)
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -752,16 +752,14 @@ static void TIFFGetProperties(TIFF *tiff,Image *image,ExceptionInfo *exception)
   if ((TIFFGetField(tiff,TIFFTAG_SOFTWARE,&text) == 1) &&
       (text != (char *) NULL))
     (void) SetImageProperty(image,"tiff:software",text,exception);
-  if ((TIFFGetField(tiff,33423,&count,&text) == 1) &&
-      (text != (char *) NULL))
+  if ((TIFFGetField(tiff,33423,&count,&text) == 1) && (text != (char *) NULL))
     {
       if (count >= MagickPathExtent)
         count=MagickPathExtent-1;
       (void) CopyMagickString(message,text,count+1);
       (void) SetImageProperty(image,"tiff:kodak-33423",message,exception);
     }
-  if ((TIFFGetField(tiff,36867,&count,&text) == 1) &&
-      (text != (char *) NULL))
+  if ((TIFFGetField(tiff,36867,&count,&text) == 1) && (text != (char *) NULL))
     {
       if (count >= MagickPathExtent)
         count=MagickPathExtent-1;
@@ -819,7 +817,7 @@ static void TIFFGetEXIFProperties(TIFF *tiff,Image *image,
     offset;
 
   void
-    *sans;
+    *sans[2] = { NULL, NULL };
 
   /*
     Read EXIF properties.
@@ -833,7 +831,6 @@ static void TIFFGetEXIFProperties(TIFF *tiff,Image *image,
       TIFFSetDirectory(tiff,directory);
       return;
     }
-  sans=NULL;
   for (i=0; exif_info[i].tag != 0; i++)
   {
     *value='\0';
@@ -845,7 +842,7 @@ static void TIFFGetEXIFProperties(TIFF *tiff,Image *image,
           *ascii;
 
         ascii=(char *) NULL;
-        if ((TIFFGetField(tiff,exif_info[i].tag,&ascii,&sans,&sans,&sans) == 1) &&
+        if ((TIFFGetField(tiff,exif_info[i].tag,&ascii,sans) == 1) &&
             (ascii != (char *) NULL) && (*ascii != '\0'))
           (void) CopyMagickString(value,ascii,MagickPathExtent);
         break;
@@ -858,7 +855,7 @@ static void TIFFGetEXIFProperties(TIFF *tiff,Image *image,
               shorty;
 
             shorty=0;
-            if (TIFFGetField(tiff,exif_info[i].tag,&shorty,&sans,&sans,&sans) == 1)
+            if (TIFFGetField(tiff,exif_info[i].tag,&shorty,sans) == 1)
               (void) FormatLocaleString(value,MagickPathExtent,"%d",shorty);
           }
         else
@@ -873,7 +870,7 @@ static void TIFFGetEXIFProperties(TIFF *tiff,Image *image,
               shorty_num;
 
             tiff_status=TIFFGetField(tiff,exif_info[i].tag,&shorty_num,&shorty,
-              &sans,&sans,&sans);
+              sans);
             if (tiff_status == 1)
               (void) FormatLocaleString(value,MagickPathExtent,"%d",
                 shorty_num != 0 ? shorty[0] : 0);
@@ -886,7 +883,7 @@ static void TIFFGetEXIFProperties(TIFF *tiff,Image *image,
           longy;
 
         longy=0;
-        if (TIFFGetField(tiff,exif_info[i].tag,&longy,&sans,&sans,&sans) == 1)
+        if (TIFFGetField(tiff,exif_info[i].tag,&longy,sans) == 1)
           (void) FormatLocaleString(value,MagickPathExtent,"%d",longy);
         break;
       }
@@ -897,7 +894,7 @@ static void TIFFGetEXIFProperties(TIFF *tiff,Image *image,
           long8y;
 
         long8y=0;
-        if (TIFFGetField(tiff,exif_info[i].tag,&long8y,&sans,&sans,&sans) == 1)
+        if (TIFFGetField(tiff,exif_info[i].tag,&long8y,sans) == 1)
           (void) FormatLocaleString(value,MagickPathExtent,"%.20g",(double)
             ((MagickOffsetType) long8y));
         break;
@@ -911,7 +908,7 @@ static void TIFFGetEXIFProperties(TIFF *tiff,Image *image,
           floaty;
 
         floaty=0.0;
-        if (TIFFGetField(tiff,exif_info[i].tag,&floaty,&sans,&sans,&sans) == 1)
+        if (TIFFGetField(tiff,exif_info[i].tag,&floaty,sans) == 1)
           (void) FormatLocaleString(value,MagickPathExtent,"%g",(double)
             floaty);
         break;
@@ -922,7 +919,7 @@ static void TIFFGetEXIFProperties(TIFF *tiff,Image *image,
           doubley;
 
         doubley=0.0;
-        if (TIFFGetField(tiff,exif_info[i].tag,&doubley,&sans,&sans,&sans) == 1)
+        if (TIFFGetField(tiff,exif_info[i].tag,&doubley,sans) == 1)
           (void) FormatLocaleString(value,MagickPathExtent,"%g",doubley);
         break;
       }