Floating point exception in function Fraction in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impacts.
Hi,

I found a FPE bug on the latest commit fd0c01d on master.
PoC: https://github.com/strongcourage/PoCs/blob/master/libheif_fd0c01d/PoC_fpe_box.cc:62
Command: examples/heif-info $PoC
Valgrind says:
~~~
==1112== Process terminating with default action of signal 8 (SIGFPE)
==1112==  Integer divide by zero at address 0x80362AC81
==1112==    at 0x528354: Fraction (box.cc:62)
==1112==    by 0x528354: operator- (box.cc:100)
==1112==    by 0x528354: heif::Box_clap::get_height_rounded() const (box.cc:2263)
==1112==    by 0x48F697: heif::HeifContext::interpret_heif_file() (heif_context.cc:696)
==1112==    by 0x49A40A: heif::HeifContext::read_from_file(char const*) (heif_context.cc:351)
==1112==    by 0x40859F: heif_context_read_from_file (heif.cc:184)
==1112==    by 0x404290: main (heif_info.cc:145)
Floating point exception
~~~
Thanks,
Manh Dung
Floating point exception
This is a GitHub Issue
repo:libheif
owner:strukturag
Title : Floating point exception
Issue date:

--- start body ---
Hi,

I found a FPE bug on the latest commit fd0c01d on master.
PoC: https://github.com/strongcourage/PoCs/blob/master/libheif_fd0c01d/PoC_fpe_box.cc:62
Command: examples/heif-info $PoC
Valgrind says:
~~~
==1112== Process terminating with default action of signal 8 (SIGFPE)
==1112==  Integer divide by zero at address 0x80362AC81
==1112==    at 0x528354: Fraction (box.cc:62)
==1112==    by 0x528354: operator- (box.cc:100)
==1112==    by 0x528354: heif::Box_clap::get_height_rounded() const (box.cc:2263)
==1112==    by 0x48F697: heif::HeifContext::interpret_heif_file() (heif_context.cc:696)
==1112==    by 0x49A40A: heif::HeifContext::read_from_file(char const*) (heif_context.cc:351)
==1112==    by 0x40859F: heif_context_read_from_file (heif.cc:184)
==1112==    by 0x404290: main (heif_info.cc:145)
Floating point exception
~~~
Thanks,
Manh Dung
--- end body ---
