diff options
| author | Campbell Barton <ideasman42@gmail.com> | 2020-11-11 08:14:09 +0300 |
|---|---|---|
| committer | Campbell Barton <ideasman42@gmail.com> | 2020-11-11 08:14:09 +0300 |
| commit | 15ffda3bcd697e6f3a0cc13e141da865f36f3b53 (patch) | |
| tree | f98d9fc831f18a9194818f5428466884654e802b /source/blender/imbuf/intern/iris.c | |
| parent | 2d60845786aeab099c61ffa42b7f72cccc68bff1 (diff) | |
Fix T82602: checking image header reads past buffer bounds
Use the size argument to ensure checking the header doesn't read
past the buffer bounds when reading corrupt/truncated headers
from image files.
Diffstat (limited to 'source/blender/imbuf/intern/iris.c')
| -rw-r--r-- | source/blender/imbuf/intern/iris.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/source/blender/imbuf/intern/iris.c b/source/blender/imbuf/intern/iris.c index c27ac5754c7..112b95bf1a1 100644 --- a/source/blender/imbuf/intern/iris.c +++ b/source/blender/imbuf/intern/iris.c @@ -243,8 +243,11 @@ static void test_endian_zbuf(struct ImBuf *ibuf) /* this one is only def-ed once, strangely... */ #define GSS(x) (((uchar *)(x))[1] << 8 | ((uchar *)(x))[0]) -bool imb_is_a_iris(const uchar *mem, size_t UNUSED(size)) +bool imb_is_a_iris(const uchar *mem, size_t size) { + if (size < 2) { + return false; + } return ((GS(mem) == IMAGIC) || (GSS(mem) == IMAGIC)); } |