Fix T46534: Crash loading corrupt HDR's

1 files changed, 6 insertions, 0 deletions

diff --git a/source/blender/imbuf/intern/radiance_hdr.c b/source/blender/imbuf/intern/radiance_hdr.c
index 5bb438f5dbe..71e74928e20 100644
--- a/source/blender/imbuf/intern/radiance_hdr.c
+++ b/source/blender/imbuf/intern/radiance_hdr.c
@@ -137,6 +137,9 @@ static const unsigned char *freadcolrs(RGBE *scan, const unsigned char *mem, int
 			code = *mem++;
 			if (code > 128) {
 				code &= 127;
+				if (UNLIKELY(code + j > xmax)) {
+					return NULL;
+				}
 				val = *mem++;
 				while (code--) {
 					scan[j++][i] = (unsigned char)val;
@@ -146,6 +149,9 @@ static const unsigned char *freadcolrs(RGBE *scan, const unsigned char *mem, int
 				if (UNLIKELY(mem_eof - mem < code)) {
 					return NULL;
 				}
+				if (UNLIKELY(code + j > xmax)) {
+					return NULL;
+				}
 				while (code--) {
 					scan[j++][i] = *mem++;
 				}