From 85b564a5b1096274752c4c50640a509f51fca214 Mon Sep 17 00:00:00 2001 From: Even Rouault Date: Sun, 14 Apr 2019 19:56:15 +0200 Subject: imw_p: avoid division by zero Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14248 Credit to OSS Fuzz --- src/projections/imw_p.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/projections/imw_p.cpp b/src/projections/imw_p.cpp index 8d675318..5455be33 100644 --- a/src/projections/imw_p.cpp +++ b/src/projections/imw_p.cpp @@ -125,7 +125,7 @@ static PJ_LP e_inverse (PJ_XY xy, PJ *P) { /* Ellipsoidal, inverse */ } lp.phi = ((lp.phi - Q->phi_1) * (xy.y - yc) / denom) + Q->phi_1; } - if( t.x != 0 || fabs(t.x - xy.x) > TOL ) + if( t.x != 0 && fabs(t.x - xy.x) > TOL ) lp.lam = lp.lam * xy.x / t.x; i ++; } while (i < N_MAX_ITER && -- cgit v1.2.3 From 47db7804524066e74fd787bdd0d7f2ba8394c220 Mon Sep 17 00:00:00 2001 From: Even Rouault Date: Sun, 14 Apr 2019 20:11:17 +0200 Subject: lcc: avoid division by zero Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14250 Credit to OSS Fuzz --- src/projections/lcc.cpp | 7 ++++++- test/gie/builtins.gie | 11 ++++++++++- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/src/projections/lcc.cpp b/src/projections/lcc.cpp index aca025be..a101009d 100644 --- a/src/projections/lcc.cpp +++ b/src/projections/lcc.cpp @@ -121,7 +121,12 @@ PJ *PROJECTION(lcc) { if( ml2 == 0 ) { return pj_default_destructor(P, PJD_ERR_LAT_1_OR_2_ZERO_OR_90); } - Q->n /= log(ml1 / ml2); + const double denom = log(ml1 / ml2); + if( denom == 0 ) { + // Not quite, but es is very close to 1... + return pj_default_destructor(P, PJD_ERR_INVALID_ECCENTRICITY); + } + Q->n /= denom; } Q->c = (Q->rho0 = m1 * pow(ml1, -Q->n) / Q->n); Q->rho0 *= (fabs(fabs(P->phi0) - M_HALFPI) < EPS10) ? 0. : diff --git a/test/gie/builtins.gie b/test/gie/builtins.gie index 7de5fccc..8e82979e 100644 --- a/test/gie/builtins.gie +++ b/test/gie/builtins.gie @@ -2740,9 +2740,18 @@ expect 1 2 ------------------------------------------------------------------------------- operation +proj=lcc +a=9999999 +b=.9 +lat_2=1 -------------------------------------------------------------------------- +------------------------------------------------------------------------------- expect failure errno invalid_eccentricity +------------------------------------------------------------------------------- +# This case is incredible. ossfuzz has found the exact value of lat_1 that +# triggers a division by zero +operation +proj=lcc +lat_1=2D32 +lat_2=0 +a=6378137 +b=0.2 +------------------------------------------------------------------------------- +expect failure +# For some reason fails on MacOSX with a different error +# errno invalid_eccentricity + ------------------------------------------------------------------------------- operation +proj=lcc +ellps=GRS80 +lat_1=0 +lat_2=90 ------------------------------------------------------------------------------- -- cgit v1.2.3