Hi,
One of our developers noticed that the Image::getColor(const Vec3&) can
potentially crash if the UV coordinates are negative. Effectively, the
following function convert UV coordinates into S,T pixel coordinates and then
calls getColor(unsigned, unsigned, unsigned). Since the latter uses unsigned as
a paremeter, any negative UV coordinates will cause an out-of-bound access in
the image buffer.
Code:
Vec4 Image::getColor(const Vec3& texcoord) const
{
int s = int(texcoord.x()*float(_s-1)) % _s;
int t = int(texcoord.y()*float(_t-1)) % _t;
int r = int(texcoord.z()*float(_r-1)) % _r;
//osg::notify(osg::NOTICE)<<"getColor("<<texcoord<<")="<<getColor(s,t,r)<<std::endl;
return getColor(s,t,r);
}
Vec4 Image::getColor(unsigned int s,unsigned t,unsigned r) const
{
const unsigned char* ptr = data(s,t,r);
switch(_dataType)
{
case(GL_BYTE): return _readColor(_pixelFormat, (char*)ptr,
1.0f/128.0f);
case(GL_UNSIGNED_BYTE): return _readColor(_pixelFormat, (unsigned
char*)ptr, 1.0f/255.0f);
case(GL_SHORT): return _readColor(_pixelFormat,
(short*)ptr, 1.0f/32768.0f);
case(GL_UNSIGNED_SHORT): return _readColor(_pixelFormat, (unsigned
short*)ptr, 1.0f/65535.0f);
case(GL_INT): return _readColor(_pixelFormat, (int*)ptr,
1.0f/2147483648.0f);
case(GL_UNSIGNED_INT): return _readColor(_pixelFormat, (unsigned
int*)ptr, 1.0f/4294967295.0f);
case(GL_FLOAT): return _readColor(_pixelFormat,
(float*)ptr, 1.0f);
}
return Vec4(1.0f,1.0f,1.0f,1.0f);
}
I would like to propose the following change to correct the problem:
Code:
Vec4 Image::getColor(const Vec3& texcoord) const
{
int s = int(texcoord.x()*float(_s-1)) % _s;
int t = int(texcoord.y()*float(_t-1)) % _t;
int r = int(texcoord.z()*float(_r-1)) % _r;
// Ensure that S,T,R coordinate are positive.
if( s < 0 ) s += _s;
if( t < 0 ) t += _t;
if( r < 0 ) r += _r;
//osg::notify(osg::NOTICE)<<"getColor("<<texcoord<<")="<<getColor(s,t,r)<<std::endl;
return getColor(s,t,r);
}
Any comments or suggestions?
Cheers,
Guy
------------------
Read this topic online here:
http://forum.openscenegraph.org/viewtopic.php?p=13621#13621
_______________________________________________
osg-users mailing list
osg-users@lists.openscenegraph.org
http://lists.openscenegraph.org/listinfo.cgi/osg-users-openscenegraph.org
