Fix: crash loading & saving large Iris images

Integer overflow in IMB_convert_rgba_to_abgr assigned a negative value
to size_t resulting in a large value which wrote past the buffer bounds.

Back ported from: d256b7f6882f1d3d6162392c81e2b3c0e62cd1a9

Pull Request: https://projects.blender.org/blender/blender/pulls/137447
This commit is contained in:
Campbell Barton
2025-04-14 10:11:33 +02:00
committed by Thomas Dinges
parent 7ce866e3c0
commit ac5b00a453
+2 -2
View File
@@ -24,7 +24,7 @@ void IMB_convert_rgba_to_abgr(ImBuf *ibuf)
float rtf, *cpf = ibuf->float_buffer.data;
if (ibuf->byte_buffer.data) {
size = ibuf->x * ibuf->y;
size = size_t(ibuf->x) * size_t(ibuf->y);
while (size-- > 0) {
rt = cp[0];
@@ -38,7 +38,7 @@ void IMB_convert_rgba_to_abgr(ImBuf *ibuf)
}
if (ibuf->float_buffer.data) {
size = ibuf->x * ibuf->y;
size = size_t(ibuf->x) * size_t(ibuf->y);
while (size-- > 0) {
rtf = cpf[0];