CVE-2017-11464: Divide By Zero (CWE-369)
value: A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file, because of incorrect protection against division by zero.
CWE description: The product divides a value by zero.
CVSS v3 base score: 7.8
Published: 2017-07-19T21:29Z
Repository: https://github.com/GNOME/librsvg
Language: C
Files changed: rsvg-filter.c
Commit date: 2017-06-27 17:12:51 -0500
Commit message: bgo#783835 - Don't divide by zero in box_blur_line() for gaussian blurs

We were making the decision to use box blurs, instead of a true
Gaussian kernel, based on the size of *both* x and y dimensions.  Do
them individually instead.

Diff: diff --git a/rsvg-filter.c b/rsvg-filter.c
index 8e61226..804d637 100644
--- a/rsvg-filter.c
+++ b/rsvg-filter.c
@@ -1415,10 +1415,12 @@ box_blur_line (gint box_width, gint even_offset,
     gint  output;  /* This marks the center of the kernel                    */
     gint  trail;   /* This marks the pixel BEHIND the last 1 in the
                       kernel; it's the pixel to remove from the accumulator. */
     gint  *ac;     /* Accumulator for each channel                           */
 
+    g_assert (box_width > 0);
+
     ac = g_new0 (gint, bpp);
 
     /* The algorithm differs for even and odd-sized kernels.
      * With the output at the center,
      * If odd, the kernel might look like this: 0011100
@@ -1772,11 +1774,10 @@ static void
 gaussian_blur_surface (cairo_surface_t *in,
                        cairo_surface_t *out,
                        gdouble sx,
                        gdouble sy)
 {
-    gboolean use_box_blur;
     gint width, height;
     cairo_format_t in_format, out_format;
     gint in_stride;
     gint out_stride;
     guchar *in_data, *out_data;
@@ -1816,18 +1817,10 @@ gaussian_blur_surface (cairo_surface_t *in,
         sx = 0.0;
 
     if (sy < 0.0)
         sy = 0.0;
 
-    /* For small radiuses, use a true gaussian kernel; otherwise use three box blurs with
-     * clever offsets.
-     */
-    if (sx < 10.0 && sy < 10.0)
-        use_box_blur = FALSE;
-    else
-        use_box_blur = TRUE;
-
     /* Bail out by just copying? */
     if ((sx == 0.0 && sy == 0.0)
         || sx > 1000 || sy > 1000) {
         cairo_t *cr;
 
@@ -1843,10 +1836,19 @@ gaussian_blur_surface (cairo_surface_t *in,
         gdouble *gaussian_matrix;
         gint gaussian_matrix_len;
         int y;
         guchar *row_buffer = NULL;
         guchar *row1, *row2;
+        gboolean use_box_blur;
+
+        /* For small radiuses, use a true gaussian kernel; otherwise use three box blurs with
+         * clever offsets.
+         */
+        if (sx < 10.0)
+            use_box_blur = FALSE;
+        else
+            use_box_blur = TRUE;
 
         if (use_box_blur) {
             box_width = compute_box_blur_width (sx);
 
             /* twice the size so we can have "two" scratch rows */
@@ -1898,10 +1900,19 @@ gaussian_blur_surface (cairo_surface_t *in,
         gdouble *gaussian_matrix = NULL;
         gint gaussian_matrix_len;
         guchar *col_buffer;
         guchar *col1, *col2;
         int x;
+        gboolean use_box_blur;
+
+        /* For small radiuses, use a true gaussian kernel; otherwise use three box blurs with
+         * clever offsets.
+         */
+        if (sy < 10.0)
+            use_box_blur = FALSE;
+        else
+            use_box_blur = TRUE;
 
         /* twice the size so we can have the source pixels and the blurred pixels */
         col_buffer = g_new0 (guchar, height * bpp * 2);
         col1 = col_buffer;
         col2 = col_buffer + height * bpp;

Vulnerable code:     gboolean use_box_blur;
    /* For small radiuses, use a true gaussian kernel; otherwise use three box blurs with
     * clever offsets.
     */
    if (sx < 10.0 && sy < 10.0)
        use_box_blur = FALSE;
    else
        use_box_blur = TRUE;

Fixed code:     g_assert (box_width > 0);

        gboolean use_box_blur;

        /* For small radiuses, use a true gaussian kernel; otherwise use three box blurs with
         * clever offsets.
         */
        if (sx < 10.0)
            use_box_blur = FALSE;
        else
            use_box_blur = TRUE;
        gboolean use_box_blur;

        /* For small radiuses, use a true gaussian kernel; otherwise use three box blurs with
         * clever offsets.
         */
        if (sy < 10.0)
            use_box_blur = FALSE;
        else
            use_box_blur = TRUE;