fix buffer overrun in make_histogram_view_from_ibuf_byte(), use define for buffer size so this wont happen again.

1 files changed, 14 insertions, 10 deletions

diff --git a/source/blender/editors/space_sequencer/sequencer_scopes.c b/source/blender/editors/space_sequencer/sequencer_scopes.c
index d09d6a29c10..6ed34a79510 100644
--- a/source/blender/editors/space_sequencer/sequencer_scopes.c
+++ b/source/blender/editors/space_sequencer/sequencer_scopes.c
@@ -449,6 +449,8 @@ static void draw_histogram_bar(ImBuf *ibuf, int x, float val, int col)
 	}
 }
 
+#define HIS_STEPS 512
+
 static ImBuf *make_histogram_view_from_ibuf_byte(ImBuf *ibuf)
 {
 	ImBuf *rval = IMB_allocImBuf(515, 128, 32, IB_rect);
@@ -456,13 +458,13 @@ static ImBuf *make_histogram_view_from_ibuf_byte(ImBuf *ibuf)
 	unsigned int n;
 	unsigned char *src = (unsigned char *) ibuf->rect;
 
-	unsigned int bins[3][256];
+	unsigned int bins[3][HIS_STEPS];
 
 	memset(bins, 0, sizeof(bins));
 
 	#pragma omp parallel for shared(bins, src, ibuf) private(x, y) if (ibuf->y >= 256)
 	for (y = 0; y < ibuf->y; y++) {
-		unsigned int cur_bins[3][512];
+		unsigned int cur_bins[3][HIS_STEPS];
 
 		memset(cur_bins, 0, sizeof(cur_bins));
 
@@ -477,7 +479,7 @@ static ImBuf *make_histogram_view_from_ibuf_byte(ImBuf *ibuf)
 		#pragma omp critical
 		{
 			int i;
-			for (i = 0; i < 512; i++) {
+			for (i = 0; i < HIS_STEPS; i++) {
 				bins[0][i] += cur_bins[0][i];
 				bins[1][i] += cur_bins[1][i];
 				bins[2][i] += cur_bins[2][i];
@@ -487,7 +489,7 @@ static ImBuf *make_histogram_view_from_ibuf_byte(ImBuf *ibuf)
 
 	n = 0;
 	for (c = 0; c < 3; c++) {
-		for (x = 0; x < 256; x++) {
+		for (x = 0; x < HIS_STEPS; x++) {
 			if (bins[c][x] > n) {
 				n = bins[c][x];
 			}
@@ -495,7 +497,7 @@ static ImBuf *make_histogram_view_from_ibuf_byte(ImBuf *ibuf)
 	}
 
 	for (c = 0; c < 3; c++) {
-		for (x = 0; x < 256; x++) {
+		for (x = 0; x < HIS_STEPS; x++) {
 			draw_histogram_bar(rval, x * 2 + 1, ((float) bins[c][x]) / n, c);
 			draw_histogram_bar(rval, x * 2 + 2, ((float) bins[c][x]) / n, c);
 		}
@@ -524,13 +526,13 @@ static ImBuf *make_histogram_view_from_ibuf_float(ImBuf *ibuf)
 	int n, c, x, y;
 	float *src = ibuf->rect_float;
 
-	unsigned int bins[3][512];
+	unsigned int bins[3][HIS_STEPS];
 
 	memset(bins, 0, sizeof(bins));
 
 	#pragma omp parallel for shared(bins, src, ibuf) private(x, y) if (ibuf->y >= 256)
 	for (y = 0; y < ibuf->y; y++) {
-		unsigned int cur_bins[3][512];
+		unsigned int cur_bins[3][HIS_STEPS];
 
 		memset(cur_bins, 0, sizeof(cur_bins));
 
@@ -545,7 +547,7 @@ static ImBuf *make_histogram_view_from_ibuf_float(ImBuf *ibuf)
 		#pragma omp critical
 		{
 			int i;
-			for (i = 0; i < 512; i++) {
+			for (i = 0; i < HIS_STEPS; i++) {
 				bins[0][i] += cur_bins[0][i];
 				bins[1][i] += cur_bins[1][i];
 				bins[2][i] += cur_bins[2][i];
@@ -558,14 +560,14 @@ static ImBuf *make_histogram_view_from_ibuf_float(ImBuf *ibuf)
 
 	n = 0;
 	for (c = 0; c < 3; c++) {
-		for (x = 0; x < 512; x++) {
+		for (x = 0; x < HIS_STEPS; x++) {
 			if (bins[c][x] > n) {
 				n = bins[c][x];
 			}
 		}
 	}
 	for (c = 0; c < 3; c++) {
-		for (x = 0; x < 512; x++) {
+		for (x = 0; x < HIS_STEPS; x++) {
 			draw_histogram_bar(rval, x + 1, (float) bins[c][x] / n, c);
 		}
 	}
@@ -575,6 +577,8 @@ static ImBuf *make_histogram_view_from_ibuf_float(ImBuf *ibuf)
 	return rval;
 }
 
+#undef HIS_STEPS
+
 ImBuf *make_histogram_view_from_ibuf(ImBuf *ibuf)
 {
 	if (ibuf->rect_float) {