From 37388c3fd7cbbee7f5d9cdeab1d748b21986aef7 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Sat, 18 Sep 2021 14:32:48 +0100
Subject: [PATCH 1/2] Regression test for
 https://github.com/Exiv2/exiv2/issues/1912

---
 test/data/issue_1912_poc.jpg             | Bin 0 -> 3754 bytes
 tests/bugfixes/github/test_issue_1912.py |  17 +++++++++++++++++
 2 files changed, 17 insertions(+)
 create mode 100644 test/data/issue_1912_poc.jpg
 create mode 100644 tests/bugfixes/github/test_issue_1912.py

diff --git a/test/data/issue_1912_poc.jpg b/test/data/issue_1912_poc.jpg
new file mode 100644
index 0000000000000000000000000000000000000000..837d2ebb015d636d47c9ff44b2b002ee4896ebba
GIT binary patch
literal 3754
zcmeHKYi!$86u#F^`kKVrGPbd0!t>Uxj3sv5rcJD-WlNVX6Dg%BZ8ss1+c>RhVh6`-
z(h3li!3IL23uV9rsB~q(#2;XTF_3tT=Re*935oF>{NeqYgvz<L;|{6tAE`IG_k2G0
zyXT&J&aq?9otpa$Rqu$#q6lMzj=~Skou;4IR!~w1#p7rbLZ|{&;-!cJR0e$<SDSb_
z;G1wQqCsN#A-oE?O^nb1yxPGJ;d+|`7O-HhT?V|vdllre`6u?(p-Kx=4}e4wN!3(q
zWV*DxtS5#wgGmIKSb|K0mt;pv3OpYa`GCj=89pQi8bu+9(3**ZB@Zai#DflAzi*@M
zO&3Cw2$h2s7cU6>Bwg~1+C1rU@TL2)#laMf_EV0Xo+3t7mKW4j#d&?Q=yLSwqTAsc
z#d3RJh*7c9#?^qU9M1LAC4c-pKaFh;oO7BgMG8+&(+=J|bDpzy&&*N>-#JrluZ4)u
zteD4#Ec=+GY_?>dV9MqYOrL{Yj?JmrvUxqwNCVI4Ga$_@E|i6ZbilVN2H`fqOldtx
z(nwZUK(ByKstvA>fPgjb_+KDbS~}1#v5|`+m5I%aQJnw*kvfE3=nXKES*nldt<w;F
zD=^4Tq~^&!cHPpwkn7Ugt5L1F7Ak}uMXSv!s0Dl@T4U;=hG{4uv#p1bm|A7aCR-Yo
z><qyDG%5sRsv+yDl=e6DD5+FL%VafGR*h|_!RCW~V#hrNG6~(jCs4_rhs^hNB)q{!
zgtjCiu^1?}@7&rQYxhQD{R_o=?sU})!-kO+IZn;_q@*?=`v$cPSCF!t-^X*PrLB;a
z21jIr8IXq*HOzkh{EIB3B*Sc9AkN3L5qVhIKCa7&@y?#X@sYt$l5J~cS_)zzlg-G6
z#1t}VH76FrtZ7^XOw=69m=t3q%=X8-n24s!Orx*S$9v6SuwX+^ro`^{sBHnR!mRCT
zKA-pH8+@8R#Q8&^5XTFgAb5e{&5fysRPd^~btMb!a&AypvWB9m46!H;XuFLt3;Uan
zNxQ+dg(4usGtLYFFo?I-F*4bO*`;`uh*@|bX}MwTU+B)XxdY3<9^z%Pnv1C^EzCA?
zex_M~f#-PA=jX#L(*z-E7JPgrW2vKQDK|`t1(r+Xlwp?V{PvupXY!IRhuNr&m|j`W
zkx)Q#ZPMj=Rn|MD46wSj0YzovN;;h*2g!;NU6u^F9eS80<>Tc8UOw1UdXQSAxRz8>
zWB);NPAd|UWfKZ$A%h&`owE~9pi@V!%wk)Nz+wazBd{2O#R&Y5A^@*oF%RB_=+$){
z9(dcN5aprT&=NirXcU5%@X$O|E2<#>hJ1hzdZ^}eFIxV=M8U1GxT_9qB2+zg_IO(C
z2-M#-b*yHn{?lvbUP3h$cr%`)@mfUHV7dm+okSPGJE0q!&0Gcpe5|<KW#tu>RZD<y
z3_jQ}O;aw~?RLS-I=+E?%(!aYwQK!b%Fe$+Drc`-CfvOL;fi%zpM3d(?stAz-!Pz0
zR8}otvGT%IbsIL;U%aU?(9|3ZiIMhg(T?r09f_VRd;9u#?ix(Wsi9%z+MKa_G+!7S
zzh%#@x9#0``yIu*r|vm$?|t_loH;c6$l*sHd;G{#Pai$@%(KUzJMqe^CtrL0jW^$V
y``!26|KP)qPJR5z>CeCT@~f}EIrHszKmPRdFTeiw`yYRvCFg=K6zf<pqQ3zn0fK4(

literal 0
HcmV?d00001

diff --git a/tests/bugfixes/github/test_issue_1912.py b/tests/bugfixes/github/test_issue_1912.py
new file mode 100644
index 00000000..de496a6a
--- /dev/null
+++ b/tests/bugfixes/github/test_issue_1912.py
@@ -0,0 +1,17 @@
+# -*- coding: utf-8 -*-
+
+from system_tests import CaseMeta, path, check_no_ASAN_UBSAN_errors
+
+class TagsIntPrint0x0007IntegerOverflow(metaclass=CaseMeta):
+    """
+    Regression test for the bug described in:
+    https://github.com/Exiv2/exiv2/issues/1912
+    """
+    url = "https://github.com/Exiv2/exiv2/issues/1912"
+
+    filename = path("$data_path/issue_1912_poc.jpg")
+    commands = ["$exiv2 -q -Pt $filename"]
+    stderr = [""]
+    retval = [0]
+
+    compare_stdout = check_no_ASAN_UBSAN_errors

From cd4316c4f50e8ff27b91a278e152405132db738b Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Mon, 20 Sep 2021 22:06:07 +0100
Subject: [PATCH 2/2] Do the calculation in floating point to avoid integer
 overflow.

---
 src/tags_int.cpp | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/src/tags_int.cpp b/src/tags_int.cpp
index 53b28ba0..e7cb50cd 100644
--- a/src/tags_int.cpp
+++ b/src/tags_int.cpp
@@ -2767,15 +2767,18 @@ namespace Exiv2 {
             }
             std::ostringstream oss;
             oss.copyfmt(os);
-            const float sec = 3600 * value.toFloat(0)
-                              + 60 * value.toFloat(1)
-                              + value.toFloat(2);
+            const double t = 3600 * value.toFloat(0)
+                             + 60 * value.toFloat(1)
+                             + value.toFloat(2);
+            enforce<std::overflow_error>(std::isfinite(t), "Non-finite time value");
             int p = 0;
-            if (sec != static_cast<int>(sec)) p = 1;
-
-            const int hh = static_cast<int>(sec / 3600);
-            const int mm = static_cast<int>((sec - 3600 * hh) / 60);
-            const float ss = sec - 3600 * hh - 60 * mm;
+            const double fraction = std::fmod(t,1);
+            if (fraction != 0) p = 1;
+            const double ss = std::fmod(t, 60);
+            const double minutes = (t - ss)/60;
+            const int mm = static_cast<int>(std::fmod(minutes, 60));
+            const double hours = (minutes - mm)/60;
+            const int hh = static_cast<int>(std::fmod(hours, 24));
 
             os << std::setw(2) << std::setfill('0') << std::right << hh << ":"
                << std::setw(2) << std::setfill('0') << std::right << mm << ":"