x/image/tiff: integer divide by zero

[dvyukov]

The following program crashes with panic:

package main

import (
    "bytes"
    "golang.org/x/image/tiff"
)

func main() {
    cfg, err := tiff.DecodeConfig(bytes.NewReader([]byte(data)))
    if err != nil || cfg.Width*cfg.Height > 1e6 {
        return
    }
    img, err := tiff.Decode(bytes.NewReader([]byte(data)))
    if err != nil {
        return
    }
    var w bytes.Buffer
    err = tiff.Encode(&w, img, nil)
    if err != nil {
        panic(err)
    }
}

var data = "II*\x00Z\x02\x00\x00000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "0.000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00000000000000000000" +
    "00\x10\x00000000000000\x00\x01\x03\x00" +
    "0\x00\x00\x000\x00\x00\x00\x01\x01\x03\x00\x01\x00\x00\x000\x0000" +
    "\x02\x01\x03\x00\x01\x00\x00\x00\x00\x0000\x03\x01\x03\x00\x01\x00\x00\x00" +
    "\x05\x80000000000000000000" +
    "00000000\x11\x01\x04\x000\x00\x00\x000\x00\x00\x00" +
    "00000000000000000000" +
    "0000000000000000\x17\x01\x04\x00" +
    "0\x00\x00\x000\x02\x00\x00000000000000" +
    "00000000000000000000" +
    "0000000000000000"

panic: runtime error: integer divide by zero

goroutine 1 [running]:
golang.org/x/image/tiff.(*decoder).decode(0xc2080700a0, 0x7ff2dbbdb3c0, 0xc208012440, 0x0, 0x0, 0x3030, 0x30, 0x0, 0x0)
    src/golang.org/x/image/tiff/reader.go:278 +0xa7c
golang.org/x/image/tiff.Decode(0x7ff2dbbdb260, 0xc208016450, 0x7ff2dbbdb3c0, 0xc208012440, 0x0, 0x0)
    src/golang.org/x/image/tiff/reader.go:656 +0xb39
main.main()
    test.go:13 +0x278

on commit 4a3ed0c1249ebedab3c715c000034638f1cad002

[gopherbot]

CL https://golang.org/cl/10485 mentions this issue.

[gopherbot]

CL https://golang.org/cl/10943 mentions this issue.