CVE-2022-38266 (C, published 2022-09-09T22:15Z)
Description: value: An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/DanBloomberg/leptonica
Files changed:
src/convolve.c
Commit message: Issue 26393: morphapp_fuzzer: Divide-by-zero in blockconvLow
* Removed the code that allowed divide by zero for tiny pix
* Ditto for 4 other block convolution functions.


Vulnerable code:
 * \param[in]    pix 8    or 32 bpp; or 2, 4 or 8 bpp with colormap
 *      (2) Returns a copy if both wc and hc are 0
 *          where (w,h) are the dimensions of pixs.
    if (wc < 0) wc = 0;
    if (hc < 0) hc = 0;
        wc = L_MIN(wc, (w - 1) / 2);
        hc = L_MIN(hc, (h - 1) / 2);
        L_WARNING("kernel too large; reducing!\n", procName);
        L_INFO("wc = %d, hc = %d\n", procName, wc, hc);
    if (wc == 0 && hc == 0)   /* no-op */
        return pixCopy(NULL, pix);
 *      (3) Returns a copy if both wc and hc are 0.
 *          where (w,h) are the dimensions of pixs.
    if (wc < 0) wc = 0;
    if (hc < 0) hc = 0;
    if (wc == 0 && hc == 0)   /* no-op */
        L_WARNING("kernel too large; returning a copy\n", procName);
        L_INFO("w = %d, wc = %d, h = %d, hc = %d\n", procName, w, wc, h, hc);
 *      (3) Returns a copy if both wc and hc are 0.
    if (wc < 0) wc = 0;
    if (hc < 0) hc = 0;
        wc = L_MIN(wc, (w - 1) / 2);
        hc = L_MIN(hc, (h - 1) / 2);
        L_WARNING("kernel too large; reducing!\n", procName);
        L_INFO("wc = %d, hc = %d\n", procName, wc, hc);
    }
    if (wc == 0 && hc == 0)   /* no-op */
 *      (2) Returns a copy if both wc and hc are 0
 *          where (w,h) are the dimensions of pixs.
    if (wc < 0) wc = 0;
    if (hc < 0) hc = 0;
    pixGetDimensions(pix, &w, &h, &d);
    if (w < 2 * wc + 3 || h < 2 * hc + 3) {
        wc = L_MAX(0, L_MIN(wc, (w - 3) / 2));
        hc = L_MAX(0, L_MIN(hc, (h - 3) / 2));
        L_WARNING("kernel too large; reducing!\n", procName);
        L_INFO("wc = %d, hc = %d\n", procName, wc, hc);
    }
    if (wc == 0 && hc == 0)   /* no-op */
 *      (3) Returns a copy if both wc and hc are 0
 *      (4) Require that w > 2 * wc + 1 and h > 2 * hc + 1,
 *          where (w,h) are the dimensions of pixs.
    if (wc < 0) wc = 0;
    if (hc < 0) hc = 0;
        wc = L_MAX(0, L_MIN(wc, (w - 3) / 2));
        hc = L_MAX(0, L_MIN(hc, (h - 3) / 2));
        L_WARNING("kernel too large; reducing!\n", procName);
        L_INFO("wc = %d, hc = %d\n", procName, wc, hc);
    }
    if (wc == 0 && hc == 0)

Fixed code:
 * \param[in]    pix      8 or 32 bpp; or 2, 4 or 8 bpp with colormap
 *      (2) Returns a copy if either wc or hc are 0
 *          where (w,h) are the dimensions of pixs.  Otherwise,
 *          return a copy.
    if (wc <= 0 || hc <= 0)
        return pixCopy(NULL, pix);
        L_ERROR("kernel is too large: w = %d, wc = %d, h = %d, hc = %d\n",
                procName, w, wc, h, hc);
        return pixCopy(NULL, pix);  /* no-op */
 *      (3) Returns a copy if either wc or hc are 0
 *          where (w,h) are the dimensions of pixs.  Otherwise,
 *          return a copy.
    if (wc <= 0 || hc <= 0)   /* no-op */
        L_ERROR("kernel is too large: w = %d, wc = %d, h = %d, hc = %d\n",
                procName, w, wc, h, hc);
 *      (3) Returns a copy if either wc or hc are 0.
    if (wc <= 0 || hc <= 0)  /* no-op */
        return pixCopy(NULL, pixs);
        L_ERROR("kernel is too large: w = %d, wc = %d, h = %d, hc = %d\n",
                procName, w, wc, h, hc);
    }
 *      (2) Returns a copy if either wc or hc are 0.
 *          where (w,h) are the dimensions of pixs.  Otherwise,
 *          return a copy.
    if (wc <= 0 || hc <= 0)   /* no-op */
    pixGetDimensions(pix, &w, &h, &d);
    if (w < 2 * wc + 3 || h < 2 * hc + 3) {
        L_ERROR("kernel is too large: w = %d, wc = %d, h = %d, hc = %d\n",
                procName, w, wc, h, hc);
        return pixCopy(NULL, pix);
    }
 *      (3) Returns a copy if either wc or hc are 0.
 *      (4) Require that w > 2 * wc + 3 and h > 2 * hc + 3,
 *          where (w,h) are the dimensions of pixs.  Otherwise,
 *          return a copy.
    if (wc <= 0 || hc <= 0)  /* no-op */
        return pixCopy(NULL, pixs);
        L_ERROR("kernel is too large: w = %d, wc = %d, h = %d, hc = %d\n",
                procName, w, wc, h, hc);
    }