diff options
| author | Campbell Barton <campbell@blender.org> | 2022-07-15 07:47:18 +0300 |
|---|---|---|
| committer | Campbell Barton <campbell@blender.org> | 2022-07-15 07:53:38 +0300 |
| commit | c8e8f107bf82fb56f49101e1098f4c697b16cfeb (patch) | |
| tree | ec045d9bd7b4309c989b778ca462b67340a9cd17 /source/blender/blendthumb | |
| parent | 675f6ef089ceeed2f03284e7e81e6af7130e46d7 (diff) | |
Fix T99711: Eternal loop reading blend file thumbnail
Account for negative BHead length (already handled by blend file loading).
Diffstat (limited to 'source/blender/blendthumb')
| -rw-r--r-- | source/blender/blendthumb/src/blendthumb_extract.cc | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/source/blender/blendthumb/src/blendthumb_extract.cc b/source/blender/blendthumb/src/blendthumb_extract.cc index 369da559fc8..163197c8b67 100644 --- a/source/blender/blendthumb/src/blendthumb_extract.cc +++ b/source/blender/blendthumb/src/blendthumb_extract.cc @@ -121,6 +121,9 @@ static eThumbStatus blendthumb_extract_from_file_impl(FileReader *file, while (file_read(file, bhead_data, bhead_size)) { /* Parse type and size from `BHead`. */ const int32_t block_size = bytes_to_native_i32(&bhead_data[4], endian_switch); + if (UNLIKELY(block_size < 0)) { + return BT_INVALID_THUMB; + } /* We're looking for the thumbnail, so skip any other block. */ switch (*((int32_t *)bhead_data)) { |