diff options
author | Campbell Barton <ideasman42@gmail.com> | 2015-10-19 18:05:52 +0300 |
---|---|---|
committer | Campbell Barton <ideasman42@gmail.com> | 2015-10-19 18:13:14 +0300 |
commit | 43c0f60523105c29e7e316c7666069ebd9c1b42a (patch) | |
tree | badbaf55434a74006c3c9b9b893aff9e73f7d912 /source/blender/imbuf | |
parent | 69c163b3671df68880f1b28ad29ae93bfa0dd890 (diff) |
Fix T46534: Crash loading corrupt HDR's
Diffstat (limited to 'source/blender/imbuf')
-rw-r--r-- | source/blender/imbuf/intern/radiance_hdr.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/source/blender/imbuf/intern/radiance_hdr.c b/source/blender/imbuf/intern/radiance_hdr.c index 5bb438f5dbe..71e74928e20 100644 --- a/source/blender/imbuf/intern/radiance_hdr.c +++ b/source/blender/imbuf/intern/radiance_hdr.c @@ -137,6 +137,9 @@ static const unsigned char *freadcolrs(RGBE *scan, const unsigned char *mem, int code = *mem++; if (code > 128) { code &= 127; + if (UNLIKELY(code + j > xmax)) { + return NULL; + } val = *mem++; while (code--) { scan[j++][i] = (unsigned char)val; @@ -146,6 +149,9 @@ static const unsigned char *freadcolrs(RGBE *scan, const unsigned char *mem, int if (UNLIKELY(mem_eof - mem < code)) { return NULL; } + if (UNLIKELY(code + j > xmax)) { + return NULL; + } while (code--) { scan[j++][i] = *mem++; } |