diff options
author | Sergey Sharybin <sergey.vfx@gmail.com> | 2017-05-26 12:27:27 +0300 |
---|---|---|
committer | Sergey Sharybin <sergey.vfx@gmail.com> | 2017-05-26 12:28:01 +0300 |
commit | bf5e717ef5617c597710c2836b511f9f089fcfc2 (patch) | |
tree | 4d55fb5f15c1055ba76ec1bc31a4c303cec494ec /source/blender/imbuf/intern/filter.c | |
parent | f78ba0df02a9734740d7ccddbe315020f56852f6 (diff) |
Fix T51609: Bake Texture, Margin crashing Blender
Integer overflow in margin filter code.
Diffstat (limited to 'source/blender/imbuf/intern/filter.c')
-rw-r--r-- | source/blender/imbuf/intern/filter.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/source/blender/imbuf/intern/filter.c b/source/blender/imbuf/intern/filter.c index 1987c6d2a9a..38609d0a342 100644 --- a/source/blender/imbuf/intern/filter.c +++ b/source/blender/imbuf/intern/filter.c @@ -406,7 +406,7 @@ void IMB_filter_extend(struct ImBuf *ibuf, char *mask, int filter) const int height = ibuf->y; const int depth = 4; /* always 4 channels */ const int chsize = ibuf->rect_float ? sizeof(float) : sizeof(unsigned char); - const int bsize = width * height * depth * chsize; + const size_t bsize = ((size_t)width) * height * depth * chsize; const bool is_float = (ibuf->rect_float != NULL); void *dstbuf = (void *) MEM_dupallocN(ibuf->rect_float ? (void *) ibuf->rect_float : (void *) ibuf->rect); char *dstmask = mask == NULL ? NULL : (char *) MEM_dupallocN(mask); @@ -499,7 +499,9 @@ void IMB_filter_extend(struct ImBuf *ibuf, char *mask, int filter) /* keep the original buffer up to date. */ memcpy(srcbuf, dstbuf, bsize); - if (dstmask != NULL) memcpy(srcmask, dstmask, width * height); + if (dstmask != NULL) { + memcpy(srcmask, dstmask, ((size_t)width) * height); + } } /* free memory */ |