diff options
Diffstat (limited to 'source/blender/imbuf/intern/radiance_hdr.c')
| -rw-r--r-- | source/blender/imbuf/intern/radiance_hdr.c | 31 |
1 files changed, 10 insertions, 21 deletions
diff --git a/source/blender/imbuf/intern/radiance_hdr.c b/source/blender/imbuf/intern/radiance_hdr.c index 925ef0a8502..7f4e4dd31df 100644 --- a/source/blender/imbuf/intern/radiance_hdr.c +++ b/source/blender/imbuf/intern/radiance_hdr.c @@ -77,7 +77,7 @@ static const unsigned char *oldreadcolrs(RGBE *scan, scan[0][BLU] = *mem++; scan[0][EXP] = *mem++; if (scan[0][RED] == 1 && scan[0][GRN] == 1 && scan[0][BLU] == 1) { - for (i = scan[0][EXP] << rshift; i > 0 && len > 0; i--) { + for (i = scan[0][EXP] << rshift; i > 0; i--) { COPY_RGBE(scan[-1], scan[0]); scan++; len--; @@ -227,7 +227,7 @@ struct ImBuf *imb_loadhdr(const unsigned char *mem, int found = 0; int width = 0, height = 0; const unsigned char *ptr, *mem_eof = mem + size; - char oriY[3], oriX[3]; + char oriY[80], oriX[80]; if (!imb_is_a_hdr(mem, size)) { return NULL; @@ -244,33 +244,22 @@ struct ImBuf *imb_loadhdr(const unsigned char *mem, } } - if ((found && (x < (size - 1))) == 0) { + if ((found && (x < (size + 2))) == 0) { /* Data not found! */ return NULL; } - x++; - - /* sscanf requires a null-terminated buffer argument */ - char buf[32] = {0}; - memcpy(buf, &mem[x], MIN2(sizeof(buf) - 1, size - x)); - - if (sscanf(buf, "%2s %d %2s %d", (char *)&oriY, &height, (char *)&oriX, &width) != 4) { - return NULL; - } - - if (width < 1 || height < 1) { + if (sscanf((const char *)&mem[x + 1], + "%79s %d %79s %d", + (char *)&oriY, + &height, + (char *)&oriX, + &width) != 4) { return NULL; } - /* Checking that width x height does not extend past mem_eof is not easily possible - * since the format uses RLE compression. Can cause excessive memory allocation to occur. */ - /* find end of this line, data right behind it */ - ptr = (const unsigned char *)strchr((const char *)&mem[x], '\n'); - if (ptr == NULL || ptr >= mem_eof) { - return NULL; - } + ptr = (const unsigned char *)strchr((const char *)&mem[x + 1], '\n'); ptr++; if (flags & IB_test) { |