commit bb217acdca1cc0c16b704669dd6f91a1b509c406
author Leon Scroggins III <scroggo@google.com> Fri Mar 09 16:23:15 2018 -0500
committer Leon Scroggins III <scroggo@google.com> Fri Mar 09 16:28:59 2018 -0500
tree ad1dbaac28851868cadbbdde7bceda97bc771a32
parent f7fc905cff18c7b883712bbfaffabd5d187bc787

Fix an uninitialized memory read in PIEX

Author: kjlubic@google.com

Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6293

src/tiff_parser.cc

diff --git a/src/tiff_parser.cc b/src/tiff_parser.cc
index 6bf3bb4..f36c5ba 100644
--- a/src/tiff_parser.cc
+++ b/src/tiff_parser.cc
@@ -165,11 +165,14 @@
   // Get color_space
   if (tiff_directory.Has(kExifTagColorSpace)) {
     std::uint32_t color_space;
-    success &= tiff_directory.Get(kExifTagColorSpace, &color_space);
-    if (color_space == 1) {
-      preview_image_data->color_space = PreviewImageData::kSrgb;
-    } else if (color_space == 65535 || color_space == 2) {
-      preview_image_data->color_space = PreviewImageData::kAdobeRgb;
+    if (tiff_directory.Get(kExifTagColorSpace, &color_space)) {
+      if (color_space == 1) {
+        preview_image_data->color_space = PreviewImageData::kSrgb;
+      } else if (color_space == 65535 || color_space == 2) {
+        preview_image_data->color_space = PreviewImageData::kAdobeRgb;
+      }
+    } else {
+      success = false;
     }
   }
 

src/tiff_parser.h

diff --git a/src/tiff_parser.h b/src/tiff_parser.h
index 84b3fc6..e809274 100644
--- a/src/tiff_parser.h
+++ b/src/tiff_parser.h
@@ -163,7 +163,7 @@
                         std::uint32_t* width, std::uint32_t* height);
 
 // Reads the width and height of the crop information if available.
-// Returns false if an error occured.
+// Returns false if an error occurred.
 bool GetFullCropDimension(const tiff_directory::TiffDirectory& tiff_directory,
                           std::uint32_t* width, std::uint32_t* height);