diff options
author | Sergey Sharybin <sergey@blender.org> | 2022-01-06 18:08:40 +0300 |
---|---|---|
committer | Sergey Sharybin <sergey@blender.org> | 2022-01-07 13:15:17 +0300 |
commit | bef2412ca253a9d3d63fc713e03997104d350f50 (patch) | |
tree | 77967e78f9db9c9d900c22996701f8ec62f3b903 /source/blender/imbuf/intern/dds/dds_api.cpp | |
parent | 29e33cfff5b6e9d2e83ae5fdb2372163fe251817 (diff) |
Fix T86952: Buffer overflow reading specific DDS images
Add a data boundary check in the flipping code.
This code now also communicates the number of mipmap levels
it processed with an intent to avoid GPU texture from using
more levels than there are in the DDS data.
Differential Revision: https://developer.blender.org/D13755
Diffstat (limited to 'source/blender/imbuf/intern/dds/dds_api.cpp')
-rw-r--r-- | source/blender/imbuf/intern/dds/dds_api.cpp | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/source/blender/imbuf/intern/dds/dds_api.cpp b/source/blender/imbuf/intern/dds/dds_api.cpp index 1729a9a64f8..f576209ff62 100644 --- a/source/blender/imbuf/intern/dds/dds_api.cpp +++ b/source/blender/imbuf/intern/dds/dds_api.cpp @@ -186,8 +186,13 @@ struct ImBuf *imb_load_dds(const unsigned char *mem, /* flip compressed texture */ if (ibuf->dds_data.data) { - FlipDXTCImage( - dds.width(), dds.height(), dds.mipmapCount(), dds.fourCC(), ibuf->dds_data.data); + FlipDXTCImage(dds.width(), + dds.height(), + ibuf->dds_data.nummipmaps, + dds.fourCC(), + ibuf->dds_data.data, + ibuf->dds_data.size, + &ibuf->dds_data.nummipmaps); } } else { |