Floating point exception in function Fraction in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impacts.
Hi,

I found a FPE bug on the latest commit fd0c01d on master.
PoC: https://github.com/strongcourage/PoCs/blob/master/libheif_fd0c01d/PoC_fpe_box.cc:62
Command: examples/heif-info $PoC
Valgrind says:
~~~
==1112== Process terminating with default action of signal 8 (SIGFPE)
==1112==  Integer divide by zero at address 0x80362AC81
==1112==    at 0x528354: Fraction (box.cc:62)
==1112==    by 0x528354: operator- (box.cc:100)
==1112==    by 0x528354: heif::Box_clap::get_height_rounded() const (box.cc:2263)
==1112==    by 0x48F697: heif::HeifContext::interpret_heif_file() (heif_context.cc:696)
==1112==    by 0x49A40A: heif::HeifContext::read_from_file(char const*) (heif_context.cc:351)
==1112==    by 0x40859F: heif_context_read_from_file (heif.cc:184)
==1112==    by 0x404290: main (heif_info.cc:145)
Floating point exception
~~~
Thanks,
Manh Dung
Floating point exception
This is a GitHub Issue
repo:libheif
owner:strukturag
Title : Floating point exception
Issue date:

--- start body ---
Hi,

I found a FPE bug on the latest commit fd0c01d on master.
PoC: https://github.com/strongcourage/PoCs/blob/master/libheif_fd0c01d/PoC_fpe_box.cc:62
Command: examples/heif-info $PoC
Valgrind says:
~~~
==1112== Process terminating with default action of signal 8 (SIGFPE)
==1112==  Integer divide by zero at address 0x80362AC81
==1112==    at 0x528354: Fraction (box.cc:62)
==1112==    by 0x528354: operator- (box.cc:100)
==1112==    by 0x528354: heif::Box_clap::get_height_rounded() const (box.cc:2263)
==1112==    by 0x48F697: heif::HeifContext::interpret_heif_file() (heif_context.cc:696)
==1112==    by 0x49A40A: heif::HeifContext::read_from_file(char const*) (heif_context.cc:351)
==1112==    by 0x40859F: heif_context_read_from_file (heif.cc:184)
==1112==    by 0x404290: main (heif_info.cc:145)
Floating point exception
~~~
Thanks,
Manh Dung
--- end body ---

A floating point exception (SIGFPE) occurs in libheif when processing certain input files, specifically due to an integer division by zero in the Fraction function. This can lead to application crashes and may be exploited to cause denial of service.