# Crash (DoS) when parsing a hostile TIFF

PHP EXIF module divides signed rationals without guarding -1/MIN_INT, causing SIGFPE crash when parsing a hostile TIFF.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: aerodudrizzt
- Disclosed: 2019-10-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/195580
- Library page: https://bugbountylibrary.com/r/h1%3A195580
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:dos

**Target:** PHP ext/exif exif_convert_any_to_int (TAG_FMT_SRATIONAL)
**Root cause:** exif_convert_any_to_int divides numerator by signed denominator without checking for the INT_MIN/-1 overflow case, which raises SIGFPE on x86.
**Steps:**
1. Craft a TIFF/EXIF file with a SRATIONAL tag whose numerator is -1 and denominator is INT_MIN (0x80000000).
2. Call `exif_thumbnail("example_hostile.exif")` in PHP.
3. Division -1 / MIN_INT triggers SIGFPE, crashing the PHP process.
**How found:** Code review of exif_convert_any_to_int; noticed the signed division lacked a guard for the INT_MIN/-1 edge case documented in Intel's IDIV spec.
**Exploitation:** Attacker supplies a crafted TIFF/EXIF image to any PHP app that parses EXIF metadata, crashing the worker process (DoS).
**Insight:** Signed integer division in parsers has an INT_MIN/-1 trap on x86; audit every signed divide in metadata/format parsers for this edge case, not just zero denominators.