diff options
author | Brecht Van Lommel <brechtvanlommel@gmail.com> | 2018-01-14 16:19:57 +0300 |
---|---|---|
committer | Brecht Van Lommel <brechtvanlommel@gmail.com> | 2018-01-17 21:59:47 +0300 |
commit | d30cc1ea0b9ba64d8a1e22105528b6cb8077692c (patch) | |
tree | 8064a8a4e305a042a8e5d6efbf26b917ca189a3e /source/blender/avi | |
parent | a6700362c71c3978acd53762e1f2e11e7f7a38b5 (diff) |
Fix buffer overflows in TIFF, PNG, IRIS, DPX, HDR and AVI loading.
Solves these security issues from T52924:
CVE-2017-2899
CVE-2017-2900
CVE-2017-2901
CVE-2017-2902
CVE-2017-2903
CVE-2017-2904
CVE-2017-2905
CVE-2017-2906
CVE-2017-2907
CVE-2017-2918
Differential Revision: https://developer.blender.org/D2999
Diffstat (limited to 'source/blender/avi')
-rw-r--r-- | source/blender/avi/CMakeLists.txt | 1 | ||||
-rw-r--r-- | source/blender/avi/intern/avi.c | 36 | ||||
-rw-r--r-- | source/blender/avi/intern/avi_codecs.c | 2 | ||||
-rw-r--r-- | source/blender/avi/intern/avi_intern.h | 2 | ||||
-rw-r--r-- | source/blender/avi/intern/avi_mjpeg.c | 92 | ||||
-rw-r--r-- | source/blender/avi/intern/avi_mjpeg.h | 4 | ||||
-rw-r--r-- | source/blender/avi/intern/avi_rgb.c | 90 | ||||
-rw-r--r-- | source/blender/avi/intern/avi_rgb.h | 4 | ||||
-rw-r--r-- | source/blender/avi/intern/avi_rgb32.c | 32 | ||||
-rw-r--r-- | source/blender/avi/intern/avi_rgb32.h | 4 |
10 files changed, 149 insertions, 118 deletions
diff --git a/source/blender/avi/CMakeLists.txt b/source/blender/avi/CMakeLists.txt index 292206d8cb9..5009bd2a30b 100644 --- a/source/blender/avi/CMakeLists.txt +++ b/source/blender/avi/CMakeLists.txt @@ -26,6 +26,7 @@ set(INC . ../blenlib + ../imbuf ../../../intern/guardedalloc ) diff --git a/source/blender/avi/intern/avi.c b/source/blender/avi/intern/avi.c index 9601d6e5002..6695998fd35 100644 --- a/source/blender/avi/intern/avi.c +++ b/source/blender/avi/intern/avi.c @@ -285,13 +285,15 @@ bool AVI_is_avi(const char *name) fseek(movie.fp, movie.header->size - 14 * 4, SEEK_CUR); - if (movie.header->Streams < 1) { - DEBUG_PRINT("streams less than 1\n"); + /* Limit number of streams to some reasonable amount to prevent + * buffer oveflow vulnerabilities. */ + if (movie.header->Streams < 1 || movie.header->Streams > 65536) { + DEBUG_PRINT("Number of streams should be in range 1-65536\n"); fclose(movie.fp); return 0; } - movie.streams = (AviStreamRec *) MEM_callocN(sizeof(AviStreamRec) * movie.header->Streams, "moviestreams"); + movie.streams = (AviStreamRec *) MEM_calloc_arrayN(movie.header->Streams, sizeof(AviStreamRec), "moviestreams"); for (temp = 0; temp < movie.header->Streams; temp++) { @@ -486,12 +488,14 @@ AviError AVI_open_movie(const char *name, AviMovie *movie) fseek(movie->fp, movie->header->size - 14 * 4, SEEK_CUR); - if (movie->header->Streams < 1) { - DEBUG_PRINT("streams less than 1\n"); + /* Limit number of streams to some reasonable amount to prevent + * buffer oveflow vulnerabilities. */ + if (movie->header->Streams < 1 || movie->header->Streams > 65536) { + DEBUG_PRINT("Number of streams should be in range 1-65536\n"); return AVI_ERROR_FORMAT; } - movie->streams = (AviStreamRec *) MEM_callocN(sizeof(AviStreamRec) * movie->header->Streams, "moviestreams"); + movie->streams = (AviStreamRec *) MEM_calloc_arrayN(movie->header->Streams, sizeof(AviStreamRec), "moviestreams"); for (temp = 0; temp < movie->header->Streams; temp++) { @@ -689,7 +693,7 @@ AviError AVI_open_movie(const char *name, AviMovie *movie) void *AVI_read_frame(AviMovie *movie, AviFormat format, int frame, int stream) { - int cur_frame = -1, temp, i = 0, rewind = 1; + int cur_frame = -1, i = 0, rewind = 1; void *buffer; /* Retrieve the record number of the desired frame in the index @@ -720,16 +724,16 @@ void *AVI_read_frame(AviMovie *movie, AviFormat format, int frame, int stream) fseek(movie->fp, movie->read_offset + movie->entries[i - 1].Offset, SEEK_SET); - temp = GET_FCC(movie->fp); - buffer = MEM_mallocN(temp, "readbuffer"); + size_t size = GET_FCC(movie->fp); + buffer = MEM_mallocN(size, "readbuffer"); - if (fread(buffer, 1, temp, movie->fp) != temp) { + if (fread(buffer, 1, size, movie->fp) != size) { MEM_freeN(buffer); return NULL; } - buffer = avi_format_convert(movie, stream, buffer, movie->streams[stream].format, format, &temp); + buffer = avi_format_convert(movie, stream, buffer, movie->streams[stream].format, format, &size); return buffer; } @@ -801,6 +805,13 @@ AviError AVI_open_compress(char *name, AviMovie *movie, int streams, ...) movie->header->Reserved[2] = 0; movie->header->Reserved[3] = 0; + /* Limit number of streams to some reasonable amount to prevent + * buffer oveflow vulnerabilities. */ + if (movie->header->Streams < 0 || movie->header->Streams > 65536) { + DEBUG_PRINT("Number of streams should be in range 0-65536\n"); + return AVI_ERROR_FORMAT; + } + movie->streams = (AviStreamRec *) MEM_mallocN(sizeof(AviStreamRec) * movie->header->Streams, "moviestreams"); va_start(ap, streams); @@ -968,7 +979,6 @@ AviError AVI_write_frame(AviMovie *movie, int frame_num, ...) int64_t rec_off; AviFormat format; void *buffer; - int size; if (frame_num < 0) return AVI_ERROR_OPTION; @@ -1002,7 +1012,7 @@ AviError AVI_write_frame(AviMovie *movie, int frame_num, ...) format = va_arg(ap, AviFormat); buffer = va_arg(ap, void *); - size = va_arg(ap, int); + size_t size = va_arg(ap, int); /* Convert the buffer into the output format */ buffer = avi_format_convert(movie, stream, buffer, format, movie->streams[stream].format, &size); diff --git a/source/blender/avi/intern/avi_codecs.c b/source/blender/avi/intern/avi_codecs.c index c14d088c8ea..f52ec44faab 100644 --- a/source/blender/avi/intern/avi_codecs.c +++ b/source/blender/avi/intern/avi_codecs.c @@ -39,7 +39,7 @@ #include "avi_mjpeg.h" #include "avi_rgb32.h" -void *avi_format_convert(AviMovie *movie, int stream, void *buffer, AviFormat from, AviFormat to, int *size) +void *avi_format_convert(AviMovie *movie, int stream, void *buffer, AviFormat from, AviFormat to, size_t *size) { if (from == to) return buffer; diff --git a/source/blender/avi/intern/avi_intern.h b/source/blender/avi/intern/avi_intern.h index 0b494047612..b2fec1edfc1 100644 --- a/source/blender/avi/intern/avi_intern.h +++ b/source/blender/avi/intern/avi_intern.h @@ -59,7 +59,7 @@ unsigned int GET_TCC(FILE *fp); putc(ch2[1], fp); \ } (void)0 -void *avi_format_convert(AviMovie *movie, int stream, void *buffer, AviFormat from, AviFormat to, int *size); +void *avi_format_convert(AviMovie *movie, int stream, void *buffer, AviFormat from, AviFormat to, size_t *size); int avi_get_data_id(AviFormat format, int stream); int avi_get_format_type(AviFormat format); diff --git a/source/blender/avi/intern/avi_mjpeg.c b/source/blender/avi/intern/avi_mjpeg.c index 1fa9da6b3a2..258426809fb 100644 --- a/source/blender/avi/intern/avi_mjpeg.c +++ b/source/blender/avi/intern/avi_mjpeg.c @@ -39,15 +39,17 @@ #include "MEM_guardedalloc.h" +#include "IMB_imbuf.h" + #include "jpeglib.h" #include "jerror.h" #include "avi_mjpeg.h" -static void jpegmemdestmgr_build(j_compress_ptr cinfo, unsigned char *buffer, int bufsize); -static void jpegmemsrcmgr_build(j_decompress_ptr dinfo, unsigned char *buffer, int bufsize); +static void jpegmemdestmgr_build(j_compress_ptr cinfo, unsigned char *buffer, size_t bufsize); +static void jpegmemsrcmgr_build(j_decompress_ptr dinfo, unsigned char *buffer, size_t bufsize); -static int numbytes; +static size_t numbytes; static void add_huff_table(j_decompress_ptr dinfo, JHUFF_TBL **htblptr, const UINT8 *bits, const UINT8 *val) { @@ -151,10 +153,8 @@ static void std_huff_tables(j_decompress_ptr dinfo) bits_ac_chrominance, val_ac_chrominance); } -static int Decode_JPEG(unsigned char *inBuffer, unsigned char *outBuffer, unsigned int width, unsigned int height, int bufsize) +static int Decode_JPEG(unsigned char *inBuffer, unsigned char *outBuffer, unsigned int width, unsigned int height, size_t bufsize) { - int rowstride; - unsigned int y; struct jpeg_decompress_struct dinfo; struct jpeg_error_mgr jerr; @@ -174,8 +174,8 @@ static int Decode_JPEG(unsigned char *inBuffer, unsigned char *outBuffer, unsign jpeg_start_decompress(&dinfo); - rowstride = dinfo.output_width * dinfo.output_components; - for (y = 0; y < dinfo.output_height; y++) { + size_t rowstride = dinfo.output_width * dinfo.output_components; + for (size_t y = 0; y < dinfo.output_height; y++) { jpeg_read_scanlines(&dinfo, (JSAMPARRAY) &outBuffer, 1); outBuffer += rowstride; } @@ -194,7 +194,7 @@ static int Decode_JPEG(unsigned char *inBuffer, unsigned char *outBuffer, unsign jpeg_start_decompress(&dinfo); rowstride = dinfo.output_width * dinfo.output_components; - for (y = 0; y < dinfo.output_height; y++) { + for (size_t y = 0; y < dinfo.output_height; y++) { jpeg_read_scanlines(&dinfo, (JSAMPARRAY) &outBuffer, 1); outBuffer += rowstride; } @@ -204,10 +204,8 @@ static int Decode_JPEG(unsigned char *inBuffer, unsigned char *outBuffer, unsign return 1; } -static void Compress_JPEG(int quality, unsigned char *outbuffer, const unsigned char *inBuffer, int width, int height, int bufsize) +static void Compress_JPEG(int quality, unsigned char *outbuffer, const unsigned char *inBuffer, int width, int height, size_t bufsize) { - int i, rowstride; - unsigned int y; struct jpeg_compress_struct cinfo; struct jpeg_error_mgr jerr; unsigned char marker[60]; @@ -240,7 +238,7 @@ static void Compress_JPEG(int quality, unsigned char *outbuffer, const unsigned jpeg_start_compress(&cinfo, false); - i = 0; + int i = 0; marker[i++] = 'A'; marker[i++] = 'V'; marker[i++] = 'I'; @@ -257,8 +255,8 @@ static void Compress_JPEG(int quality, unsigned char *outbuffer, const unsigned jpeg_write_marker(&cinfo, JPEG_COM, marker, 60); - rowstride = cinfo.image_width * cinfo.input_components; - for (y = 0; y < cinfo.image_height; y++) { + size_t rowstride = cinfo.image_width * cinfo.input_components; + for (size_t y = 0; y < cinfo.image_height; y++) { jpeg_write_scanlines(&cinfo, (JSAMPARRAY) &inBuffer, 1); inBuffer += rowstride; } @@ -268,7 +266,7 @@ static void Compress_JPEG(int quality, unsigned char *outbuffer, const unsigned static void interlace(unsigned char *to, unsigned char *from, int width, int height) { - int i, rowstride = width * 3; + size_t i, rowstride = width * 3; for (i = 0; i < height; i++) { if (i & 1) @@ -280,7 +278,7 @@ static void interlace(unsigned char *to, unsigned char *from, int width, int hei static void deinterlace(int odd, unsigned char *to, unsigned char *from, int width, int height) { - int i, rowstride = width * 3; + size_t i, rowstride = width * 3; for (i = 0; i < height; i++) { if ((i & 1) == odd) @@ -290,22 +288,27 @@ static void deinterlace(int odd, unsigned char *to, unsigned char *from, int wid } } -void *avi_converter_from_mjpeg(AviMovie *movie, int stream, unsigned char *buffer, int *size) +void *avi_converter_from_mjpeg(AviMovie *movie, int stream, unsigned char *buffer, size_t *size) { int deint; unsigned char *buf; (void)stream; /* unused */ - buf = MEM_mallocN(movie->header->Height * movie->header->Width * 3, "avi.avi_converter_from_mjpeg 1"); + buf = imb_alloc_pixels(movie->header->Height, movie->header->Width, 3, sizeof(unsigned char), "avi.avi_converter_from_mjpeg 1"); + if (!buf) { + return NULL; + } deint = Decode_JPEG(buffer, buf, movie->header->Width, movie->header->Height, *size); MEM_freeN(buffer); if (deint) { - buffer = MEM_mallocN(movie->header->Height * movie->header->Width * 3, "avi.avi_converter_from_mjpeg 2"); - interlace(buffer, buf, movie->header->Width, movie->header->Height); + buffer = imb_alloc_pixels(movie->header->Height, movie->header->Width, 3, sizeof(unsigned char), "avi.avi_converter_from_mjpeg 2"); + if (buffer) { + interlace(buffer, buf, movie->header->Width, movie->header->Height); + } MEM_freeN(buf); buf = buffer; @@ -314,43 +317,50 @@ void *avi_converter_from_mjpeg(AviMovie *movie, int stream, unsigned char *buffe return buf; } -void *avi_converter_to_mjpeg(AviMovie *movie, int stream, unsigned char *buffer, int *size) +void *avi_converter_to_mjpeg(AviMovie *movie, int stream, unsigned char *buffer, size_t *size) { unsigned char *buf; - int bufsize = *size; + size_t bufsize = *size; numbytes = 0; *size = 0; - buf = MEM_mallocN(movie->header->Height * movie->header->Width * 3, "avi.avi_converter_to_mjpeg 1"); + buf = imb_alloc_pixels(movie->header->Height, movie->header->Width, 3, sizeof(unsigned char), "avi.avi_converter_to_mjpeg 1"); + if (!buf) { + return NULL; + } + if (!movie->interlace) { Compress_JPEG(movie->streams[stream].sh.Quality / 100, buf, buffer, movie->header->Width, movie->header->Height, bufsize); + *size += numbytes; } else { deinterlace(movie->odd_fields, buf, buffer, movie->header->Width, movie->header->Height); MEM_freeN(buffer); buffer = buf; - buf = MEM_mallocN(movie->header->Height * movie->header->Width * 3, "avi.avi_converter_to_mjpeg 2"); - - Compress_JPEG(movie->streams[stream].sh.Quality / 100, - buf, buffer, - movie->header->Width, - movie->header->Height / 2, - bufsize / 2); - *size += numbytes; - numbytes = 0; - Compress_JPEG(movie->streams[stream].sh.Quality / 100, - buf + *size, buffer + (movie->header->Height / 2) * movie->header->Width * 3, - movie->header->Width, - movie->header->Height / 2, - bufsize / 2); + buf = imb_alloc_pixels(movie->header->Height, movie->header->Width, 3, sizeof(unsigned char), "avi.avi_converter_to_mjpeg 1"); + + if (buf) { + Compress_JPEG(movie->streams[stream].sh.Quality / 100, + buf, buffer, + movie->header->Width, + movie->header->Height / 2, + bufsize / 2); + *size += numbytes; + numbytes = 0; + Compress_JPEG(movie->streams[stream].sh.Quality / 100, + buf + *size, buffer + (size_t)(movie->header->Height / 2) * (size_t)movie->header->Width * 3, + movie->header->Width, + movie->header->Height / 2, + bufsize / 2); + *size += numbytes; + } } - *size += numbytes; MEM_freeN(buffer); return buf; @@ -377,7 +387,7 @@ static void jpegmemdestmgr_term_destination(j_compress_ptr cinfo) MEM_freeN(cinfo->dest); } -static void jpegmemdestmgr_build(j_compress_ptr cinfo, unsigned char *buffer, int bufsize) +static void jpegmemdestmgr_build(j_compress_ptr cinfo, unsigned char *buffer, size_t bufsize) { cinfo->dest = MEM_mallocN(sizeof(*(cinfo->dest)), "avi.jpegmemdestmgr_build"); @@ -430,7 +440,7 @@ static void jpegmemsrcmgr_term_source(j_decompress_ptr dinfo) MEM_freeN(dinfo->src); } -static void jpegmemsrcmgr_build(j_decompress_ptr dinfo, unsigned char *buffer, int bufsize) +static void jpegmemsrcmgr_build(j_decompress_ptr dinfo, unsigned char *buffer, size_t bufsize) { dinfo->src = MEM_mallocN(sizeof(*(dinfo->src)), "avi.jpegmemsrcmgr_build"); diff --git a/source/blender/avi/intern/avi_mjpeg.h b/source/blender/avi/intern/avi_mjpeg.h index e8cba1849e7..e1e3cdf1fd8 100644 --- a/source/blender/avi/intern/avi_mjpeg.h +++ b/source/blender/avi/intern/avi_mjpeg.h @@ -32,7 +32,7 @@ #ifndef __AVI_MJPEG_H__ #define __AVI_MJPEG_H__ -void *avi_converter_from_mjpeg(AviMovie *movie, int stream, unsigned char *buffer, int *size); -void *avi_converter_to_mjpeg(AviMovie *movie, int stream, unsigned char *buffer, int *size); +void *avi_converter_from_mjpeg(AviMovie *movie, int stream, unsigned char *buffer, size_t *size); +void *avi_converter_to_mjpeg(AviMovie *movie, int stream, unsigned char *buffer, size_t *size); #endif /* __AVI_MJPEG_H__ */ diff --git a/source/blender/avi/intern/avi_rgb.c b/source/blender/avi/intern/avi_rgb.c index 632ecad61a6..f0baf7c6c14 100644 --- a/source/blender/avi/intern/avi_rgb.c +++ b/source/blender/avi/intern/avi_rgb.c @@ -40,11 +40,12 @@ #include "AVI_avi.h" #include "avi_rgb.h" +#include "IMB_imbuf.h" + /* implementation */ -void *avi_converter_from_avi_rgb(AviMovie *movie, int stream, unsigned char *buffer, int *size) +void *avi_converter_from_avi_rgb(AviMovie *movie, int stream, unsigned char *buffer, size_t *size) { - int x, y, i, rowstride; unsigned char *buf; AviBitmapInfoHeader *bi; short bits = 32; @@ -60,33 +61,35 @@ void *avi_converter_from_avi_rgb(AviMovie *movie, int stream, unsigned char *buf #ifdef __BIG_ENDIAN__ unsigned char *pxla; #endif - - buf = MEM_mallocN(movie->header->Height * movie->header->Width * 3, "fromavirgbbuf"); - y = movie->header->Height; - to = buf; + buf = imb_alloc_pixels(movie->header->Height, movie->header->Width, 3, sizeof(unsigned char), "fromavirgbbuf"); + + if (buf) { + size_t y = movie->header->Height; + to = buf; + + while (y--) { + pxl = (unsigned short *) (buffer + y * movie->header->Width * 2); - while (y--) { - pxl = (unsigned short *) (buffer + y * movie->header->Width * 2); - #ifdef __BIG_ENDIAN__ - pxla = (unsigned char *)pxl; + pxla = (unsigned char *)pxl; #endif - x = movie->header->Width; - while (x--) { + size_t x = movie->header->Width; + while (x--) { #ifdef __BIG_ENDIAN__ - i = pxla[0]; - pxla[0] = pxla[1]; - pxla[1] = i; - - pxla += 2; + int i = pxla[0]; + pxla[0] = pxla[1]; + pxla[1] = i; + + pxla += 2; #endif - - *(to++) = ((*pxl >> 10) & 0x1f) * 8; - *(to++) = ((*pxl >> 5) & 0x1f) * 8; - *(to++) = (*pxl & 0x1f) * 8; - pxl++; + + *(to++) = ((*pxl >> 10) & 0x1f) * 8; + *(to++) = ((*pxl >> 5) & 0x1f) * 8; + *(to++) = (*pxl & 0x1f) * 8; + pxl++; + } } } @@ -95,48 +98,49 @@ void *avi_converter_from_avi_rgb(AviMovie *movie, int stream, unsigned char *buf return buf; } else { - buf = MEM_mallocN(movie->header->Height * movie->header->Width * 3, "fromavirgbbuf"); - - rowstride = movie->header->Width * 3; - if ((bits != 16) && (movie->header->Width % 2)) rowstride++; - - for (y = 0; y < movie->header->Height; y++) { - memcpy(&buf[y * movie->header->Width * 3], &buffer[((movie->header->Height - 1) - y) * rowstride], movie->header->Width * 3); - } + buf = imb_alloc_pixels(movie->header->Height, movie->header->Width, 3, sizeof(unsigned char), "fromavirgbbuf"); - for (y = 0; y < movie->header->Height * movie->header->Width * 3; y += 3) { - i = buf[y]; - buf[y] = buf[y + 2]; - buf[y + 2] = i; + if (buf) { + size_t rowstride = movie->header->Width * 3; + if ((bits != 16) && (movie->header->Width % 2)) rowstride++; + + for (size_t y = 0; y < movie->header->Height; y++) { + memcpy(&buf[y * movie->header->Width * 3], &buffer[((movie->header->Height - 1) - y) * rowstride], movie->header->Width * 3); + } + + for (size_t y = 0; y < (size_t)movie->header->Height * (size_t)movie->header->Width * 3; y += 3) { + int i = buf[y]; + buf[y] = buf[y + 2]; + buf[y + 2] = i; + } } - + MEM_freeN(buffer); - + return buf; } } -void *avi_converter_to_avi_rgb(AviMovie *movie, int stream, unsigned char *buffer, int *size) +void *avi_converter_to_avi_rgb(AviMovie *movie, int stream, unsigned char *buffer, size_t *size) { - int y, x, i, rowstride; unsigned char *buf; (void)stream; /* unused */ - rowstride = movie->header->Width * 3; + size_t rowstride = movie->header->Width * 3; /* AVI files has uncompressed lines 4-byte aligned */ rowstride = (rowstride + 3) & ~3; *size = movie->header->Height * rowstride; buf = MEM_mallocN(*size, "toavirgbbuf"); - for (y = 0; y < movie->header->Height; y++) { + for (size_t y = 0; y < movie->header->Height; y++) { memcpy(&buf[y * rowstride], &buffer[((movie->header->Height - 1) - y) * movie->header->Width * 3], movie->header->Width * 3); } - for (y = 0; y < movie->header->Height; y++) { - for (x = 0; x < movie->header->Width * 3; x += 3) { - i = buf[y * rowstride + x]; + for (size_t y = 0; y < movie->header->Height; y++) { + for (size_t x = 0; x < movie->header->Width * 3; x += 3) { + int i = buf[y * rowstride + x]; buf[y * rowstride + x] = buf[y * rowstride + x + 2]; buf[y * rowstride + x + 2] = i; } diff --git a/source/blender/avi/intern/avi_rgb.h b/source/blender/avi/intern/avi_rgb.h index 773166e9fab..67bb4172769 100644 --- a/source/blender/avi/intern/avi_rgb.h +++ b/source/blender/avi/intern/avi_rgb.h @@ -32,7 +32,7 @@ #ifndef __AVI_RGB_H__ #define __AVI_RGB_H__ -void *avi_converter_from_avi_rgb(AviMovie *movie, int stream, unsigned char *buffer, int *size); -void *avi_converter_to_avi_rgb(AviMovie *movie, int stream, unsigned char *buffer, int *size); +void *avi_converter_from_avi_rgb(AviMovie *movie, int stream, unsigned char *buffer, size_t *size); +void *avi_converter_to_avi_rgb(AviMovie *movie, int stream, unsigned char *buffer, size_t *size); #endif /* __AVI_RGB_H__ */ diff --git a/source/blender/avi/intern/avi_rgb32.c b/source/blender/avi/intern/avi_rgb32.c index c9cbcb05bb8..051fdba1cd2 100644 --- a/source/blender/avi/intern/avi_rgb32.c +++ b/source/blender/avi/intern/avi_rgb32.c @@ -37,24 +37,28 @@ #include "MEM_guardedalloc.h" +#include "IMB_imbuf.h" + #include "AVI_avi.h" #include "avi_rgb32.h" -void *avi_converter_from_rgb32(AviMovie *movie, int stream, unsigned char *buffer, int *size) +void *avi_converter_from_rgb32(AviMovie *movie, int stream, unsigned char *buffer, size_t *size) { - int y, x, rowstridea, rowstrideb; unsigned char *buf; (void)stream; /* unused */ - buf = MEM_mallocN(movie->header->Height * movie->header->Width * 3, "fromrgb32buf"); - *size = movie->header->Height * movie->header->Width * 3; + *size = (size_t)movie->header->Height * (size_t)movie->header->Width * 3; + buf = imb_alloc_pixels(movie->header->Height, movie->header->Width, 3, sizeof(unsigned char), "fromrgb32buf"); + if (!buf) { + return NULL; + } - rowstridea = movie->header->Width * 3; - rowstrideb = movie->header->Width * 4; + size_t rowstridea = movie->header->Width * 3; + size_t rowstrideb = movie->header->Width * 4; - for (y = 0; y < movie->header->Height; y++) { - for (x = 0; x < movie->header->Width; x++) { + for (size_t y = 0; y < movie->header->Height; y++) { + for (size_t x = 0; x < movie->header->Width; x++) { buf[y * rowstridea + x * 3 + 0] = buffer[y * rowstrideb + x * 4 + 3]; buf[y * rowstridea + x * 3 + 1] = buffer[y * rowstrideb + x * 4 + 2]; buf[y * rowstridea + x * 3 + 2] = buffer[y * rowstrideb + x * 4 + 1]; @@ -66,21 +70,23 @@ void *avi_converter_from_rgb32(AviMovie *movie, int stream, unsigned char *buffe return buf; } -void *avi_converter_to_rgb32(AviMovie *movie, int stream, unsigned char *buffer, int *size) +void *avi_converter_to_rgb32(AviMovie *movie, int stream, unsigned char *buffer, size_t *size) { - int i; unsigned char *buf; unsigned char *to, *from; (void)stream; /* unused */ - *size = movie->header->Height * movie->header->Width * 4; - buf = MEM_mallocN(*size, "torgb32buf"); + *size = (size_t)movie->header->Height * (size_t)movie->header->Width * 4; + buf = imb_alloc_pixels(movie->header->Height, movie->header->Width, 3, sizeof(unsigned char), "torgb32buf"); + if (!buf) { + return NULL; + } memset(buf, 255, *size); to = buf; from = buffer; - i = movie->header->Height * movie->header->Width; + size_t i = (size_t)movie->header->Height * (size_t)movie->header->Width; while (i--) { memcpy(to, from, 3); diff --git a/source/blender/avi/intern/avi_rgb32.h b/source/blender/avi/intern/avi_rgb32.h index 523f9e795fd..a9373a69821 100644 --- a/source/blender/avi/intern/avi_rgb32.h +++ b/source/blender/avi/intern/avi_rgb32.h @@ -32,7 +32,7 @@ #ifndef __AVI_RGB32_H__ #define __AVI_RGB32_H__ -void *avi_converter_from_rgb32(AviMovie *movie, int stream, unsigned char *buffer, int *size); -void *avi_converter_to_rgb32(AviMovie *movie, int stream, unsigned char *buffer, int *size); +void *avi_converter_from_rgb32(AviMovie *movie, int stream, unsigned char *buffer, size_t *size); +void *avi_converter_to_rgb32(AviMovie *movie, int stream, unsigned char *buffer, size_t *size); #endif /* __AVI_RGB32_H__ */ |