Fix: crash loading & saving large Iris images
Integer overflow in IMB_convert_rgba_to_abgr assigned a negative value to size_t resulting in a large value which wrote past the buffer bounds. Back ported from: d256b7f6882f1d3d6162392c81e2b3c0e62cd1a9 Pull Request: https://projects.blender.org/blender/blender/pulls/137447
This commit is contained in:
committed by
Thomas Dinges
parent
7ce866e3c0
commit
ac5b00a453
@@ -24,7 +24,7 @@ void IMB_convert_rgba_to_abgr(ImBuf *ibuf)
|
||||
float rtf, *cpf = ibuf->float_buffer.data;
|
||||
|
||||
if (ibuf->byte_buffer.data) {
|
||||
size = ibuf->x * ibuf->y;
|
||||
size = size_t(ibuf->x) * size_t(ibuf->y);
|
||||
|
||||
while (size-- > 0) {
|
||||
rt = cp[0];
|
||||
@@ -38,7 +38,7 @@ void IMB_convert_rgba_to_abgr(ImBuf *ibuf)
|
||||
}
|
||||
|
||||
if (ibuf->float_buffer.data) {
|
||||
size = ibuf->x * ibuf->y;
|
||||
size = size_t(ibuf->x) * size_t(ibuf->y);
|
||||
|
||||
while (size-- > 0) {
|
||||
rtf = cpf[0];
|
||||
|
||||
Reference in New Issue
Block a user