Commit: 43c0f60523105c29e7e316c7666069ebd9c1b42a
Author: Campbell Barton
Date: Tue Oct 20 02:05:52 2015 +1100
Branches: master
https://developer.blender.org/rB43c0f60523105c29e7e316c7666069ebd9c1b42a
Fix T46534: Crash loading corrupt HDR's
===================================================================
M source/blender/imbuf/intern/radiance_hdr.c
===================================================================
diff --git a/source/blender/imbuf/intern/radiance_hdr.c
b/source/blender/imbuf/intern/radiance_hdr.c
index 5bb438f..71e7492 100644
--- a/source/blender/imbuf/intern/radiance_hdr.c
+++ b/source/blender/imbuf/intern/radiance_hdr.c
@@ -137,6 +137,9 @@ static const unsigned char *freadcolrs(RGBE *scan, const
unsigned char *mem, int
code = *mem++;
if (code > 128) {
code &= 127;
+ if (UNLIKELY(code + j > xmax)) {
+ return NULL;
+ }
val = *mem++;
while (code--) {
scan[j++][i] = (unsigned char)val;
@@ -146,6 +149,9 @@ static const unsigned char *freadcolrs(RGBE *scan, const
unsigned char *mem, int
if (UNLIKELY(mem_eof - mem < code)) {
return NULL;
}
+ if (UNLIKELY(code + j > xmax)) {
+ return NULL;
+ }
while (code--) {
scan[j++][i] = *mem++;
}
_______________________________________________
Bf-blender-cvs mailing list
[email protected]
http://lists.blender.org/mailman/listinfo/bf-blender-cvs
