diff options
Diffstat (limited to 'source/blender/imbuf/intern')
-rw-r--r-- | source/blender/imbuf/intern/allocimbuf.c | 40 | ||||
-rw-r--r-- | source/blender/imbuf/intern/bmp.c | 30 | ||||
-rw-r--r-- | source/blender/imbuf/intern/cineon/dpxlib.c | 3 | ||||
-rw-r--r-- | source/blender/imbuf/intern/cineon/logImageCore.c | 101 | ||||
-rw-r--r-- | source/blender/imbuf/intern/cineon/logImageCore.h | 2 | ||||
-rw-r--r-- | source/blender/imbuf/intern/iris.c | 67 | ||||
-rw-r--r-- | source/blender/imbuf/intern/png.c | 54 | ||||
-rw-r--r-- | source/blender/imbuf/intern/radiance_hdr.c | 39 | ||||
-rw-r--r-- | source/blender/imbuf/intern/tiff.c | 26 |
9 files changed, 192 insertions, 170 deletions
diff --git a/source/blender/imbuf/intern/allocimbuf.c b/source/blender/imbuf/intern/allocimbuf.c index 6e9bfa1fc4e..7fc4a65d8d7 100644 --- a/source/blender/imbuf/intern/allocimbuf.c +++ b/source/blender/imbuf/intern/allocimbuf.c @@ -265,15 +265,11 @@ ImBuf *IMB_makeSingleUser(ImBuf *ibuf) bool addzbufImBuf(ImBuf *ibuf) { - size_t size; - if (ibuf == NULL) return false; IMB_freezbufImBuf(ibuf); - size = (size_t)ibuf->x * (size_t)ibuf->y * sizeof(unsigned int); - - if ((ibuf->zbuf = MEM_mapallocN(size, __func__))) { + if ((ibuf->zbuf = imb_alloc_pixels(ibuf->x, ibuf->y, 1, sizeof(unsigned int), __func__))) { ibuf->mall |= IB_zbuf; ibuf->flags |= IB_zbuf; return true; @@ -284,15 +280,11 @@ bool addzbufImBuf(ImBuf *ibuf) bool addzbuffloatImBuf(ImBuf *ibuf) { - size_t size; - if (ibuf == NULL) return false; IMB_freezbuffloatImBuf(ibuf); - size = (size_t)ibuf->x * (size_t)ibuf->y * sizeof(float); - - if ((ibuf->zbuf_float = MEM_mapallocN(size, __func__))) { + if ((ibuf->zbuf_float = imb_alloc_pixels(ibuf->x, ibuf->y, 1, sizeof(float), __func__))) { ibuf->mall |= IB_zbuffloat; ibuf->flags |= IB_zbuffloat; return true; @@ -361,19 +353,31 @@ bool imb_enlargeencodedbufferImBuf(ImBuf *ibuf) return true; } +void *imb_alloc_pixels(unsigned int x, + unsigned int y, + unsigned int channels, + size_t typesize, + const char *name) +{ + /* Protect against buffer overflow vulnerabilities from files specifying + * a width and height that overflow and alloc too little memory. */ + if (!((uint64_t)x * (uint64_t)y < (SIZE_MAX / (channels * typesize)))) { + return NULL; + } + + size_t size = (size_t)x * (size_t)y * (size_t)channels * typesize; + return MEM_mapallocN(size, name); +} + bool imb_addrectfloatImBuf(ImBuf *ibuf) { - size_t size; - if (ibuf == NULL) return false; if (ibuf->rect_float) imb_freerectfloatImBuf(ibuf); /* frees mipmap too, hrm */ - size = (size_t)ibuf->x * (size_t)ibuf->y * sizeof(float[4]); - ibuf->channels = 4; - if ((ibuf->rect_float = MEM_mapallocN(size, __func__))) { + if ((ibuf->rect_float = imb_alloc_pixels(ibuf->x, ibuf->y, 4, sizeof(float), __func__))) { ibuf->mall |= IB_rectfloat; ibuf->flags |= IB_rectfloat; return true; @@ -385,8 +389,6 @@ bool imb_addrectfloatImBuf(ImBuf *ibuf) /* question; why also add zbuf? */ bool imb_addrectImBuf(ImBuf *ibuf) { - size_t size; - if (ibuf == NULL) return false; /* don't call imb_freerectImBuf, it frees mipmaps, this call is used only too give float buffers display */ @@ -394,9 +396,7 @@ bool imb_addrectImBuf(ImBuf *ibuf) MEM_freeN(ibuf->rect); ibuf->rect = NULL; - size = (size_t)ibuf->x * (size_t)ibuf->y * sizeof(unsigned int); - - if ((ibuf->rect = MEM_mapallocN(size, __func__))) { + if ((ibuf->rect = imb_alloc_pixels(ibuf->x, ibuf->y, 4, sizeof(unsigned char), __func__))) { ibuf->mall |= IB_rect; ibuf->flags |= IB_rect; if (ibuf->planes > 32) { diff --git a/source/blender/imbuf/intern/bmp.c b/source/blender/imbuf/intern/bmp.c index c5694148127..e63699ea5ba 100644 --- a/source/blender/imbuf/intern/bmp.c +++ b/source/blender/imbuf/intern/bmp.c @@ -124,7 +124,7 @@ struct ImBuf *imb_bmp_decode(const unsigned char *mem, size_t size, int flags, c { struct ImBuf *ibuf = NULL; BMPINFOHEADER bmi; - int x, y, depth, ibuf_depth, skip, i, j; + int x, y, depth, ibuf_depth, skip; const unsigned char *bmp; unsigned char *rect; unsigned short col; @@ -179,13 +179,17 @@ struct ImBuf *imb_bmp_decode(const unsigned char *mem, size_t size, int flags, c } else { ibuf = IMB_allocImBuf(x, y, ibuf_depth, IB_rect); + if (!ibuf) { + return NULL; + } + rect = (unsigned char *) ibuf->rect; if (depth <= 8) { const int rowsize = (depth * x + 31) / 32 * 4; const char (*palette)[4] = (void *)(mem + skip); const int startmask = ((1 << depth) - 1) << 8; - for (i = y; i > 0; i--) { + for (size_t i = y; i > 0; i--) { int index; int bitoffs = 8; int bitmask = startmask; @@ -194,7 +198,7 @@ struct ImBuf *imb_bmp_decode(const unsigned char *mem, size_t size, int flags, c if (top_to_bottom) { rect = (unsigned char *) &ibuf->rect[(i - 1) * x]; } - for (j = x; j > 0; j--) { + for (size_t j = x; j > 0; j--) { bitoffs -= depth; bitmask >>= depth; index = (bmp[0] & bitmask) >> bitoffs; @@ -219,11 +223,11 @@ struct ImBuf *imb_bmp_decode(const unsigned char *mem, size_t size, int flags, c } } else if (depth == 16) { - for (i = y; i > 0; i--) { + for (size_t i = y; i > 0; i--) { if (top_to_bottom) { rect = (unsigned char *) &ibuf->rect[(i - 1) * x]; } - for (j = x; j > 0; j--) { + for (size_t j = x; j > 0; j--) { col = bmp[0] + (bmp[1] << 8); rect[0] = ((col >> 10) & 0x1f) << 3; rect[1] = ((col >> 5) & 0x1f) << 3; @@ -236,11 +240,11 @@ struct ImBuf *imb_bmp_decode(const unsigned char *mem, size_t size, int flags, c } else if (depth == 24) { const int x_pad = x % 4; - for (i = y; i > 0; i--) { + for (size_t i = y; i > 0; i--) { if (top_to_bottom) { rect = (unsigned char *) &ibuf->rect[(i - 1) * x]; } - for (j = x; j > 0; j--) { + for (size_t j = x; j > 0; j--) { rect[0] = bmp[2]; rect[1] = bmp[1]; rect[2] = bmp[0]; @@ -253,11 +257,11 @@ struct ImBuf *imb_bmp_decode(const unsigned char *mem, size_t size, int flags, c } } else if (depth == 32) { - for (i = y; i > 0; i--) { + for (size_t i = y; i > 0; i--) { if (top_to_bottom) { rect = (unsigned char *) &ibuf->rect[(i - 1) * x]; } - for (j = x; j > 0; j--) { + for (size_t j = x; j > 0; j--) { rect[0] = bmp[2]; rect[1] = bmp[1]; rect[2] = bmp[0]; @@ -299,7 +303,7 @@ static int putShortLSB(unsigned short us, FILE *ofile) int imb_savebmp(struct ImBuf *ibuf, const char *name, int flags) { BMPINFOHEADER infoheader; - int bytesize, extrabytes, x, y, t, ptr; + size_t bytesize, extrabytes, ptr; uchar *data; FILE *ofile; @@ -331,15 +335,15 @@ int imb_savebmp(struct ImBuf *ibuf, const char *name, int flags) putIntLSB(0, ofile); /* Need to write out padded image data in bgr format */ - for (y = 0; y < ibuf->y; y++) { - for (x = 0; x < ibuf->x; x++) { + for (size_t y = 0; y < ibuf->y; y++) { + for (size_t x = 0; x < ibuf->x; x++) { ptr = (x + y * ibuf->x) * 4; if (putc(data[ptr + 2], ofile) == EOF) return 0; if (putc(data[ptr + 1], ofile) == EOF) return 0; if (putc(data[ptr], ofile) == EOF) return 0; } /* add padding here */ - for (t = 0; t < extrabytes; t++) { + for (size_t t = 0; t < extrabytes; t++) { if (putc(0, ofile) == EOF) return 0; } } diff --git a/source/blender/imbuf/intern/cineon/dpxlib.c b/source/blender/imbuf/intern/cineon/dpxlib.c index 1e4f299def7..b6e8b43b009 100644 --- a/source/blender/imbuf/intern/cineon/dpxlib.c +++ b/source/blender/imbuf/intern/cineon/dpxlib.c @@ -193,7 +193,8 @@ LogImageFile *dpxOpen(const unsigned char *byteStuff, int fromMemory, size_t buf dpx->srcFormat = format_DPX; dpx->numElements = swap_ushort(header.imageHeader.elements_per_image, dpx->isMSB); - if (dpx->numElements == 0) { + size_t max_elements = sizeof(header.imageHeader.element)/sizeof(header.imageHeader.element[0]); + if (dpx->numElements == 0 || dpx->numElements >= max_elements) { if (verbose) printf("DPX: Wrong number of elements: %d\n", dpx->numElements); logImageClose(dpx); return NULL; diff --git a/source/blender/imbuf/intern/cineon/logImageCore.c b/source/blender/imbuf/intern/cineon/logImageCore.c index 7b5dec4da41..bb72f675cb8 100644 --- a/source/blender/imbuf/intern/cineon/logImageCore.c +++ b/source/blender/imbuf/intern/cineon/logImageCore.c @@ -38,6 +38,8 @@ #include "BLI_fileops.h" #include "BLI_utildefines.h" +#include "IMB_imbuf.h" + #include "MEM_guardedalloc.h" /* @@ -162,7 +164,7 @@ void logImageGetSize(LogImageFile *logImage, int *width, int *height, int *depth * Helper */ -unsigned int getRowLength(int width, LogImageElement logElement) +size_t getRowLength(size_t width, LogImageElement logElement) { /* return the row length in bytes according to width and packing method */ switch (logElement.bitsPerSample) { @@ -201,7 +203,7 @@ int logImageSetDataRGBA(LogImageFile *logImage, float *data, int dataIsLinearRGB float *elementData; int returnValue; - elementData = (float *)MEM_mallocN(logImage->width * logImage->height * logImage->depth * sizeof(float), __func__); + elementData = (float *)imb_alloc_pixels(logImage->width, logImage->height, logImage->depth, sizeof(float), __func__); if (elementData == NULL) return 1; @@ -238,9 +240,8 @@ int logImageSetDataRGBA(LogImageFile *logImage, float *data, int dataIsLinearRGB static int logImageSetData8(LogImageFile *logImage, LogImageElement logElement, float *data) { - unsigned int rowLength = getRowLength(logImage->width, logElement); + size_t rowLength = getRowLength(logImage->width, logElement); unsigned char *row; - int x, y; row = (unsigned char *)MEM_mallocN(rowLength, __func__); if (row == NULL) { @@ -249,8 +250,8 @@ static int logImageSetData8(LogImageFile *logImage, LogImageElement logElement, } memset(row, 0, rowLength); - for (y = 0; y < logImage->height; y++) { - for (x = 0; x < logImage->width * logImage->depth; x++) + for (size_t y = 0; y < logImage->height; y++) { + for (size_t x = 0; x < logImage->width * logImage->depth; x++) row[x] = (unsigned char)float_uint(data[y * logImage->width * logImage->depth + x], 255); if (logimage_fwrite(row, rowLength, 1, logImage) == 0) { @@ -265,10 +266,9 @@ static int logImageSetData8(LogImageFile *logImage, LogImageElement logElement, static int logImageSetData10(LogImageFile *logImage, LogImageElement logElement, float *data) { - unsigned int rowLength = getRowLength(logImage->width, logElement); + size_t rowLength = getRowLength(logImage->width, logElement); unsigned int pixel, index; unsigned int *row; - int x, y, offset; row = (unsigned int *)MEM_mallocN(rowLength, __func__); if (row == NULL) { @@ -276,12 +276,12 @@ static int logImageSetData10(LogImageFile *logImage, LogImageElement logElement, return 1; } - for (y = 0; y < logImage->height; y++) { - offset = 22; + for (size_t y = 0; y < logImage->height; y++) { + int offset = 22; index = 0; pixel = 0; - for (x = 0; x < logImage->width * logImage->depth; x++) { + for (size_t x = 0; x < logImage->width * logImage->depth; x++) { pixel |= (unsigned int)float_uint(data[y * logImage->width * logImage->depth + x], 1023) << offset; offset -= 10; if (offset < 0) { @@ -308,9 +308,8 @@ static int logImageSetData10(LogImageFile *logImage, LogImageElement logElement, static int logImageSetData12(LogImageFile *logImage, LogImageElement logElement, float *data) { - unsigned int rowLength = getRowLength(logImage->width, logElement); + size_t rowLength = getRowLength(logImage->width, logElement); unsigned short *row; - int x, y; row = (unsigned short *)MEM_mallocN(rowLength, __func__); if (row == NULL) { @@ -318,8 +317,8 @@ static int logImageSetData12(LogImageFile *logImage, LogImageElement logElement, return 1; } - for (y = 0; y < logImage->height; y++) { - for (x = 0; x < logImage->width * logImage->depth; x++) + for (size_t y = 0; y < logImage->height; y++) { + for (size_t x = 0; x < logImage->width * logImage->depth; x++) row[x] = swap_ushort(((unsigned short)float_uint(data[y * logImage->width * logImage->depth + x], 4095)) << 4, logImage->isMSB); if (logimage_fwrite(row, rowLength, 1, logImage) == 0) { @@ -334,9 +333,8 @@ static int logImageSetData12(LogImageFile *logImage, LogImageElement logElement, static int logImageSetData16(LogImageFile *logImage, LogImageElement logElement, float *data) { - unsigned int rowLength = getRowLength(logImage->width, logElement); + size_t rowLength = getRowLength(logImage->width, logElement); unsigned short *row; - int x, y; row = (unsigned short *)MEM_mallocN(rowLength, __func__); if (row == NULL) { @@ -344,8 +342,8 @@ static int logImageSetData16(LogImageFile *logImage, LogImageElement logElement, return 1; } - for (y = 0; y < logImage->height; y++) { - for (x = 0; x < logImage->width * logImage->depth; x++) + for (size_t y = 0; y < logImage->height; y++) { + for (size_t x = 0; x < logImage->width * logImage->depth; x++) row[x] = swap_ushort((unsigned short)float_uint(data[y * logImage->width * logImage->depth + x], 65535), logImage->isMSB); if (logimage_fwrite(row, rowLength, 1, logImage) == 0) { @@ -382,7 +380,7 @@ int logImageGetDataRGBA(LogImageFile *logImage, float *data, int dataIsLinearRGB /* descriptor_Depth and descriptor_Composite are not supported */ if (logImage->element[i].descriptor != descriptor_Depth && logImage->element[i].descriptor != descriptor_Composite) { /* Allocate memory */ - elementData[i] = (float *)MEM_mallocN(logImage->width * logImage->height * logImage->element[i].depth * sizeof(float), __func__); + elementData[i] = imb_alloc_pixels(logImage->width, logImage->height, logImage->element[i].depth, sizeof(float), __func__); if (elementData[i] == NULL) { if (verbose) printf("DPX/Cineon: Cannot allocate memory for elementData[%d]\n.", i); for (j = 0; j < i; j++) @@ -530,7 +528,7 @@ int logImageGetDataRGBA(LogImageFile *logImage, float *data, int dataIsLinearRGB } } - mergedData = (float *)MEM_mallocN(logImage->width * logImage->height * mergedElement.depth * sizeof(float), __func__); + mergedData = (float *)imb_alloc_pixels(logImage->width, logImage->height, mergedElement.depth, sizeof(float), __func__); if (mergedData == NULL) { if (verbose) printf("DPX/Cineon: Cannot allocate mergedData.\n"); for (i = 0; i < logImage->numElements; i++) @@ -590,7 +588,6 @@ static int logImageElementGetData(LogImageFile *logImage, LogImageElement logEle static int logImageElementGetData1(LogImageFile *logImage, LogImageElement logElement, float *data) { unsigned int pixel; - int x, y, offset; /* seek at the right place */ if (logimage_fseek(logImage, logElement.dataOffset, SEEK_SET) != 0) { @@ -599,14 +596,14 @@ static int logImageElementGetData1(LogImageFile *logImage, LogImageElement logEl } /* read 1 bit data padded to 32 bits */ - for (y = 0; y < logImage->height; y++) { - for (x = 0; x < logImage->width * logElement.depth; x += 32) { + for (size_t y = 0; y < logImage->height; y++) { + for (size_t x = 0; x < logImage->width * logElement.depth; x += 32) { if (logimage_read_uint(&pixel, logImage) != 0) { if (verbose) printf("DPX/Cineon: EOF reached\n"); return 1; } pixel = swap_uint(pixel, logImage->isMSB); - for (offset = 0; offset < 32 && x + offset < logImage->width; offset++) + for (int offset = 0; offset < 32 && x + offset < logImage->width; offset++) data[y * logImage->width * logElement.depth + x + offset] = (float)((pixel >> offset) & 0x01); } } @@ -615,19 +612,18 @@ static int logImageElementGetData1(LogImageFile *logImage, LogImageElement logEl static int logImageElementGetData8(LogImageFile *logImage, LogImageElement logElement, float *data) { - unsigned int rowLength = getRowLength(logImage->width, logElement); + size_t rowLength = getRowLength(logImage->width, logElement); unsigned char pixel; - int x, y; /* extract required pixels */ - for (y = 0; y < logImage->height; y++) { + for (size_t y = 0; y < logImage->height; y++) { /* 8 bits are 32-bits padded so we need to seek at each row */ if (logimage_fseek(logImage, logElement.dataOffset + y * rowLength, SEEK_SET) != 0) { - if (verbose) printf("DPX/Cineon: Couldn't seek at %d\n", logElement.dataOffset + y * (int)rowLength); + if (verbose) printf("DPX/Cineon: Couldn't seek at %d\n", (int)(logElement.dataOffset + y * rowLength)); return 1; } - for (x = 0; x < logImage->width * logElement.depth; x++) { + for (size_t x = 0; x < logImage->width * logElement.depth; x++) { if (logimage_read_uchar(&pixel, logImage) != 0) { if (verbose) printf("DPX/Cineon: EOF reached\n"); return 1; @@ -641,7 +637,6 @@ static int logImageElementGetData8(LogImageFile *logImage, LogImageElement logEl static int logImageElementGetData10(LogImageFile *logImage, LogImageElement logElement, float *data) { unsigned int pixel; - int x, y, offset; /* seek to data */ if (logimage_fseek(logImage, logElement.dataOffset, SEEK_SET) != 0) { @@ -650,9 +645,9 @@ static int logImageElementGetData10(LogImageFile *logImage, LogImageElement logE } if (logImage->depth == 1 && logImage->srcFormat == format_DPX) { - for (y = 0; y < logImage->height; y++) { - offset = 32; - for (x = 0; x < logImage->width * logElement.depth; x++) { + for (size_t y = 0; y < logImage->height; y++) { + int offset = 32; + for (size_t x = 0; x < logImage->width * logElement.depth; x++) { /* we need to read the next long */ if (offset >= 30) { if (logElement.packing == 1) @@ -672,9 +667,9 @@ static int logImageElementGetData10(LogImageFile *logImage, LogImageElement logE } } else { - for (y = 0; y < logImage->height; y++) { - offset = -1; - for (x = 0; x < logImage->width * logElement.depth; x++) { + for (size_t y = 0; y < logImage->height; y++) { + int offset = -1; + for (size_t x = 0; x < logImage->width * logElement.depth; x++) { /* we need to read the next long */ if (offset < 0) { if (logElement.packing == 1) @@ -699,23 +694,22 @@ static int logImageElementGetData10(LogImageFile *logImage, LogImageElement logE static int logImageElementGetData10Packed(LogImageFile *logImage, LogImageElement logElement, float *data) { - unsigned int rowLength = getRowLength(logImage->width, logElement); + size_t rowLength = getRowLength(logImage->width, logElement); unsigned int pixel, oldPixel; - int offset, offset2, x, y; /* converting bytes to pixels */ - for (y = 0; y < logImage->height; y++) { + for (size_t y = 0; y < logImage->height; y++) { /* seek to data */ if (logimage_fseek(logImage, y * rowLength + logElement.dataOffset, SEEK_SET) != 0) { - if (verbose) printf("DPX/Cineon: Couldn't seek at %u\n", y * rowLength + logElement.dataOffset); + if (verbose) printf("DPX/Cineon: Couldn't seek at %u\n", (unsigned int)(y * rowLength + logElement.dataOffset)); return 1; } oldPixel = 0; - offset = 0; - offset2 = 0; + int offset = 0; + int offset2 = 0; - for (x = 0; x < logImage->width * logElement.depth; x++) { + for (size_t x = 0; x < logImage->width * logElement.depth; x++) { if (offset2 != 0) { offset = 10 - offset2; offset2 = 0; @@ -778,23 +772,22 @@ static int logImageElementGetData12(LogImageFile *logImage, LogImageElement logE static int logImageElementGetData12Packed(LogImageFile *logImage, LogImageElement logElement, float *data) { - unsigned int rowLength = getRowLength(logImage->width, logElement); + size_t rowLength = getRowLength(logImage->width, logElement); unsigned int pixel, oldPixel; - int offset, offset2, x, y; /* converting bytes to pixels */ - for (y = 0; y < logImage->height; y++) { + for (size_t y = 0; y < logImage->height; y++) { /* seek to data */ if (logimage_fseek(logImage, y * rowLength + logElement.dataOffset, SEEK_SET) != 0) { - if (verbose) printf("DPX/Cineon: Couldn't seek at %u\n", y * rowLength + logElement.dataOffset); + if (verbose) printf("DPX/Cineon: Couldn't seek at %u\n", (unsigned int)(y * rowLength + logElement.dataOffset)); return 1; } oldPixel = 0; - offset = 0; - offset2 = 0; + int offset = 0; + int offset2 = 0; - for (x = 0; x < logImage->width * logElement.depth; x++) { + for (size_t x = 0; x < logImage->width * logElement.depth; x++) { if (offset2 != 0) { offset = 12 - offset2; offset2 = 0; @@ -1119,7 +1112,7 @@ static int convertRGBA_RGBA(float *src, float *dst, LogImageFile *logImage, case transfer_UserDefined: case transfer_Linear: case transfer_Logarithmic: { - memcpy(dst, src, 4 * logImage->width * logImage->height * sizeof(float)); + memcpy(dst, src, 4 * (size_t)logImage->width * (size_t)logImage->height * sizeof(float)); return 0; } @@ -1434,11 +1427,11 @@ static int convertRGBAToLogElement(float *src, float *dst, LogImageFile *logImag if (srcIsLinearRGB != 0) { /* we need to convert src to sRGB */ - srgbSrc = (float *)MEM_mallocN(4 * logImage->width * logImage->height * sizeof(float), __func__); + srgbSrc = (float *)imb_alloc_pixels(logImage->width, logImage->height, 4, sizeof(float), __func__); if (srgbSrc == NULL) return 1; - memcpy(srgbSrc, src, 4 * logImage->width * logImage->height * sizeof(float)); + memcpy(srgbSrc, src, 4 * (size_t)logImage->width * (size_t)logImage->height * sizeof(float)); srgbSrc_ptr = srgbSrc; /* convert data from Linear RGB to sRGB via lut */ diff --git a/source/blender/imbuf/intern/cineon/logImageCore.h b/source/blender/imbuf/intern/cineon/logImageCore.h index e39df1ea096..b6f4fff73f6 100644 --- a/source/blender/imbuf/intern/cineon/logImageCore.h +++ b/source/blender/imbuf/intern/cineon/logImageCore.h @@ -196,7 +196,7 @@ LogImageFile *logImageCreate(const char *filename, int cineon, int width, int he void logImageClose(LogImageFile *logImage); /* Data handling */ -unsigned int getRowLength(int width, LogImageElement logElement); +size_t getRowLength(size_t width, LogImageElement logElement); int logImageSetDataRGBA(LogImageFile *logImage, float *data, int dataIsLinearRGB); int logImageGetDataRGBA(LogImageFile *logImage, float *data, int dataIsLinearRGB); diff --git a/source/blender/imbuf/intern/iris.c b/source/blender/imbuf/intern/iris.c index 6c0849358a5..55727ed6697 100644 --- a/source/blender/imbuf/intern/iris.c +++ b/source/blender/imbuf/intern/iris.c @@ -260,9 +260,8 @@ struct ImBuf *imb_loadiris(const uchar *mem, size_t size, int flags, char colors const uchar *mem_end = mem + size; MFileOffset _inf_data = {mem, 0}, *inf = &_inf_data; IMAGE image; - int x, y, z, tablen; int bpp, rle, cur, badorder; - ImBuf *ibuf; + ImBuf *ibuf = NULL; uchar dirty_flag = 0; if (size < HEADER_SIZE) { @@ -304,7 +303,7 @@ struct ImBuf *imb_loadiris(const uchar *mem, size_t size, int flags, char colors } if (rle) { - tablen = ysize * zsize * sizeof(int); + size_t tablen = (size_t)ysize * (size_t)zsize * sizeof(int); MFILE_SEEK(inf, HEADER_SIZE); uint *starttab = MEM_mallocN(tablen, "iris starttab"); @@ -321,8 +320,8 @@ struct ImBuf *imb_loadiris(const uchar *mem, size_t size, int flags, char colors /* check data order */ cur = 0; badorder = 0; - for (y = 0; y < ysize; y++) { - for (z = 0; z < zsize; z++) { + for (size_t y = 0; y < ysize; y++) { + for (size_t z = 0; z < zsize; z++) { if (starttab[y + z * ysize] < cur) { badorder = 1; break; @@ -336,14 +335,17 @@ struct ImBuf *imb_loadiris(const uchar *mem, size_t size, int flags, char colors if (bpp == 1) { ibuf = IMB_allocImBuf(xsize, ysize, 8 * zsize, IB_rect); + if (!ibuf) { + goto fail_rle; + } if (ibuf->planes > 32) ibuf->planes = 32; base = ibuf->rect; zbase = (uint *)ibuf->zbuf; if (badorder) { - for (z = 0; z < zsize; z++) { + for (size_t z = 0; z < zsize; z++) { lptr = base; - for (y = 0; y < ysize; y++) { + for (size_t y = 0; y < ysize; y++) { MFILE_SEEK(inf, starttab[y + z * ysize]); rledat = MFILE_DATA(inf); MFILE_STEP(inf, lengthtab[y + z * ysize]); @@ -358,12 +360,12 @@ struct ImBuf *imb_loadiris(const uchar *mem, size_t size, int flags, char colors else { lptr = base; zptr = zbase; - for (y = 0; y < ysize; y++) { + for (size_t y = 0; y < ysize; y++) { uint *lptr_next = lptr + xsize; uint *zptr_next = zptr + xsize; - for (z = 0; z < zsize; z++) { + for (size_t z = 0; z < zsize; z++) { MFILE_SEEK(inf, starttab[y + z * ysize]); rledat = MFILE_DATA(inf); MFILE_STEP(inf, lengthtab[y + z * ysize]); @@ -386,13 +388,16 @@ struct ImBuf *imb_loadiris(const uchar *mem, size_t size, int flags, char colors else { /* bpp == 2 */ ibuf = IMB_allocImBuf(xsize, ysize, 32, (flags & IB_rect) | IB_rectfloat); - + if (!ibuf) { + goto fail_rle; + } + fbase = ibuf->rect_float; if (badorder) { - for (z = 0; z < zsize; z++) { + for (size_t z = 0; z < zsize; z++) { fptr = fbase; - for (y = 0; y < ysize; y++) { + for (size_t y = 0; y < ysize; y++) { MFILE_SEEK(inf, starttab[y + z * ysize]); rledat = MFILE_DATA(inf); MFILE_STEP(inf, lengthtab[y + z * ysize]); @@ -408,9 +413,9 @@ struct ImBuf *imb_loadiris(const uchar *mem, size_t size, int flags, char colors fptr = fbase; float *fptr_next = fptr + (xsize * 4); - for (y = 0; y < ysize; y++) { + for (size_t y = 0; y < ysize; y++) { - for (z = 0; z < zsize; z++) { + for (size_t z = 0; z < zsize; z++) { MFILE_SEEK(inf, starttab[y + z * ysize]); rledat = MFILE_DATA(inf); MFILE_STEP(inf, lengthtab[y + z * ysize]); @@ -426,6 +431,10 @@ struct ImBuf *imb_loadiris(const uchar *mem, size_t size, int flags, char colors fail_rle: MEM_freeN(starttab); MEM_freeN(lengthtab); + + if (!ibuf) { + return NULL; + } } else { @@ -435,6 +444,9 @@ fail_rle: if (bpp == 1) { ibuf = IMB_allocImBuf(xsize, ysize, 8 * zsize, IB_rect); + if (!ibuf) { + goto fail_uncompressed; + } if (ibuf->planes > 32) ibuf->planes = 32; base = ibuf->rect; @@ -443,12 +455,12 @@ fail_rle: MFILE_SEEK(inf, HEADER_SIZE); rledat = MFILE_DATA(inf); - for (z = 0; z < zsize; z++) { + for (size_t z = 0; z < zsize; z++) { if (z < 4) lptr = base; else if (z < 8) lptr = zbase; - for (y = 0; y < ysize; y++) { + for (size_t y = 0; y < ysize; y++) { const uchar *rledat_next = rledat + xsize; const int z_ofs = 3 - z; MFILE_CAPACITY_AT_PTR_OK_OR_FAIL(rledat_next + z_ofs); @@ -462,17 +474,20 @@ fail_rle: else { /* bpp == 2 */ ibuf = IMB_allocImBuf(xsize, ysize, 32, (flags & IB_rect) | IB_rectfloat); + if (!ibuf) { + goto fail_uncompressed; + } fbase = ibuf->rect_float; MFILE_SEEK(inf, HEADER_SIZE); rledat = MFILE_DATA(inf); - for (z = 0; z < zsize; z++) { + for (size_t z = 0; z < zsize; z++) { fptr = fbase; - for (y = 0; y < ysize; y++) { + for (size_t y = 0; y < ysize; y++) { const uchar *rledat_next = rledat + xsize * 2; const int z_ofs = 3 - z; MFILE_CAPACITY_AT_PTR_OK_OR_FAIL(rledat_next + z_ofs); @@ -485,7 +500,9 @@ fail_rle: } #undef MFILE_CAPACITY_AT_PTR_OK_OR_FAIL fail_uncompressed: - (void)0; + if (!ibuf) { + return NULL; + } } if (bpp == 1) { @@ -493,7 +510,7 @@ fail_uncompressed: if (image.zsize == 1) { rect = (uchar *) ibuf->rect; - for (x = ibuf->x * ibuf->y; x > 0; x--) { + for (size_t x = (size_t)ibuf->x * (size_t)ibuf->y; x > 0; x--) { rect[0] = 255; rect[1] = rect[2] = rect[3]; rect += 4; @@ -502,7 +519,7 @@ fail_uncompressed: else if (image.zsize == 2) { /* grayscale with alpha */ rect = (uchar *) ibuf->rect; - for (x = ibuf->x * ibuf->y; x > 0; x--) { + for (size_t x = (size_t)ibuf->x * (size_t)ibuf->y; x > 0; x--) { rect[0] = rect[2]; rect[1] = rect[2] = rect[3]; rect += 4; @@ -511,7 +528,7 @@ fail_uncompressed: else if (image.zsize == 3) { /* add alpha */ rect = (uchar *) ibuf->rect; - for (x = ibuf->x * ibuf->y; x > 0; x--) { + for (size_t x = (size_t)ibuf->x * (size_t)ibuf->y; x > 0; x--) { rect[0] = 255; rect += 4; } @@ -522,7 +539,7 @@ fail_uncompressed: if (image.zsize == 1) { fbase = ibuf->rect_float; - for (x = ibuf->x * ibuf->y; x > 0; x--) { + for (size_t x = (size_t)ibuf->x * (size_t)ibuf->y; x > 0; x--) { fbase[0] = 1; fbase[1] = fbase[2] = fbase[3]; fbase += 4; @@ -531,7 +548,7 @@ fail_uncompressed: else if (image.zsize == 2) { /* grayscale with alpha */ fbase = ibuf->rect_float; - for (x = ibuf->x * ibuf->y; x > 0; x--) { + for (size_t x = (size_t)ibuf->x * (size_t)ibuf->y; x > 0; x--) { fbase[0] = fbase[2]; fbase[1] = fbase[2] = fbase[3]; fbase += 4; @@ -540,7 +557,7 @@ fail_uncompressed: else if (image.zsize == 3) { /* add alpha */ fbase = ibuf->rect_float; - for (x = ibuf->x * ibuf->y; x > 0; x--) { + for (size_t x = (size_t)ibuf->x * (size_t)ibuf->y; x > 0; x--) { fbase[0] = 1; fbase += 4; } diff --git a/source/blender/imbuf/intern/png.c b/source/blender/imbuf/intern/png.c index dded0f7aecf..857f72e10eb 100644 --- a/source/blender/imbuf/intern/png.c +++ b/source/blender/imbuf/intern/png.c @@ -526,7 +526,7 @@ ImBuf *imb_loadpng(const unsigned char *mem, size_t size, int flags, char colors unsigned char *from, *to; unsigned short *from16; float *to_float; - int i, bytesperpixel; + unsigned int channels; if (imb_is_a_png(mem) == 0) return(NULL); @@ -571,7 +571,7 @@ ImBuf *imb_loadpng(const unsigned char *mem, size_t size, int flags, char colors png_get_IHDR(png_ptr, info_ptr, &width, &height, &bit_depth, &color_type, NULL, NULL, NULL); - bytesperpixel = png_get_channels(png_ptr, info_ptr); + channels = png_get_channels(png_ptr, info_ptr); switch (color_type) { case PNG_COLOR_TYPE_RGB: @@ -580,10 +580,10 @@ ImBuf *imb_loadpng(const unsigned char *mem, size_t size, int flags, char colors case PNG_COLOR_TYPE_PALETTE: png_set_palette_to_rgb(png_ptr); if (png_get_valid(png_ptr, info_ptr, PNG_INFO_tRNS)) { - bytesperpixel = 4; + channels = 4; } else { - bytesperpixel = 3; + channels = 3; } break; case PNG_COLOR_TYPE_GRAY: @@ -593,7 +593,7 @@ ImBuf *imb_loadpng(const unsigned char *mem, size_t size, int flags, char colors bit_depth = 8; if (png_get_valid(png_ptr, info_ptr, PNG_INFO_tRNS)) { /* PNG_COLOR_TYPE_GRAY may also have alpha 'values', like with palette. */ - bytesperpixel = 2; + channels = 2; } } break; @@ -602,7 +602,7 @@ ImBuf *imb_loadpng(const unsigned char *mem, size_t size, int flags, char colors longjmp(png_jmpbuf(png_ptr), 1); } - ibuf = IMB_allocImBuf(width, height, 8 * bytesperpixel, 0); + ibuf = IMB_allocImBuf(width, height, 8 * channels, 0); if (ibuf) { ibuf->ftype = IMB_FTYPE_PNG; @@ -630,23 +630,23 @@ ImBuf *imb_loadpng(const unsigned char *mem, size_t size, int flags, char colors imb_addrectfloatImBuf(ibuf); png_set_swap(png_ptr); - pixels16 = MEM_mallocN(ibuf->x * ibuf->y * bytesperpixel * sizeof(png_uint_16), "pixels"); - if (pixels16 == NULL) { + pixels16 = imb_alloc_pixels(ibuf->x, ibuf->y, channels, sizeof(png_uint_16), "pixels"); + if (pixels16 == NULL || ibuf->rect_float == NULL) { printf("Cannot allocate pixels array\n"); longjmp(png_jmpbuf(png_ptr), 1); } /* allocate memory for an array of row-pointers */ - row_pointers = (png_bytepp) MEM_mallocN(ibuf->y * sizeof(png_uint_16p), "row_pointers"); + row_pointers = (png_bytepp) MEM_mallocN((size_t)ibuf->y * sizeof(png_uint_16p), "row_pointers"); if (row_pointers == NULL) { printf("Cannot allocate row-pointers array\n"); longjmp(png_jmpbuf(png_ptr), 1); } /* set the individual row-pointers to point at the correct offsets */ - for (i = 0; i < ibuf->y; i++) { + for (size_t i = 0; i < ibuf->y; i++) { row_pointers[ibuf->y - 1 - i] = (png_bytep) - ((png_uint_16 *)pixels16 + (i * ibuf->x) * bytesperpixel); + ((png_uint_16 *)pixels16 + (i * ibuf->x) * channels); } png_read_image(png_ptr, row_pointers); @@ -656,9 +656,9 @@ ImBuf *imb_loadpng(const unsigned char *mem, size_t size, int flags, char colors to_float = ibuf->rect_float; from16 = pixels16; - switch (bytesperpixel) { + switch (channels) { case 4: - for (i = ibuf->x * ibuf->y; i > 0; i--) { + for (size_t i = (size_t)ibuf->x * (size_t)ibuf->y; i > 0; i--) { to_float[0] = from16[0] / 65535.0; to_float[1] = from16[1] / 65535.0; to_float[2] = from16[2] / 65535.0; @@ -667,7 +667,7 @@ ImBuf *imb_loadpng(const unsigned char *mem, size_t size, int flags, char colors } break; case 3: - for (i = ibuf->x * ibuf->y; i > 0; i--) { + for (size_t i = (size_t)ibuf->x * (size_t)ibuf->y; i > 0; i--) { to_float[0] = from16[0] / 65535.0; to_float[1] = from16[1] / 65535.0; to_float[2] = from16[2] / 65535.0; @@ -676,14 +676,14 @@ ImBuf *imb_loadpng(const unsigned char *mem, size_t size, int flags, char colors } break; case 2: - for (i = ibuf->x * ibuf->y; i > 0; i--) { + for (size_t i = (size_t)ibuf->x * (size_t)ibuf->y; i > 0; i--) { to_float[0] = to_float[1] = to_float[2] = from16[0] / 65535.0; to_float[3] = from16[1] / 65535.0; to_float += 4; from16 += 2; } break; case 1: - for (i = ibuf->x * ibuf->y; i > 0; i--) { + for (size_t i = (size_t)ibuf->x * (size_t)ibuf->y; i > 0; i--) { to_float[0] = to_float[1] = to_float[2] = from16[0] / 65535.0; to_float[3] = 1.0; to_float += 4; from16++; @@ -694,23 +694,23 @@ ImBuf *imb_loadpng(const unsigned char *mem, size_t size, int flags, char colors else { imb_addrectImBuf(ibuf); - pixels = MEM_mallocN(((size_t)ibuf->x) * ibuf->y * bytesperpixel * sizeof(unsigned char), "pixels"); - if (pixels == NULL) { + pixels = imb_alloc_pixels(ibuf->x, ibuf->y, channels, sizeof(unsigned char), "pixels"); + if (pixels == NULL || ibuf->rect == NULL) { printf("Cannot allocate pixels array\n"); longjmp(png_jmpbuf(png_ptr), 1); } /* allocate memory for an array of row-pointers */ - row_pointers = (png_bytepp) MEM_mallocN(ibuf->y * sizeof(png_bytep), "row_pointers"); + row_pointers = (png_bytepp) MEM_mallocN((size_t)ibuf->y * sizeof(png_bytep), "row_pointers"); if (row_pointers == NULL) { printf("Cannot allocate row-pointers array\n"); longjmp(png_jmpbuf(png_ptr), 1); } /* set the individual row-pointers to point at the correct offsets */ - for (i = 0; i < ibuf->y; i++) { + for (int i = 0; i < ibuf->y; i++) { row_pointers[ibuf->y - 1 - i] = (png_bytep) - ((unsigned char *)pixels + (((size_t)i) * ibuf->x) * bytesperpixel * sizeof(unsigned char)); + ((unsigned char *)pixels + (((size_t)i) * ibuf->x) * channels * sizeof(unsigned char)); } png_read_image(png_ptr, row_pointers); @@ -720,9 +720,9 @@ ImBuf *imb_loadpng(const unsigned char *mem, size_t size, int flags, char colors to = (unsigned char *) ibuf->rect; from = pixels; - switch (bytesperpixel) { + switch (channels) { case 4: - for (i = ibuf->x * ibuf->y; i > 0; i--) { + for (size_t i = (size_t)ibuf->x * (size_t)ibuf->y; i > 0; i--) { to[0] = from[0]; to[1] = from[1]; to[2] = from[2]; @@ -731,7 +731,7 @@ ImBuf *imb_loadpng(const unsigned char *mem, size_t size, int flags, char colors } break; case 3: - for (i = ibuf->x * ibuf->y; i > 0; i--) { + for (size_t i = (size_t)ibuf->x * (size_t)ibuf->y; i > 0; i--) { to[0] = from[0]; to[1] = from[1]; to[2] = from[2]; @@ -740,14 +740,14 @@ ImBuf *imb_loadpng(const unsigned char *mem, size_t size, int flags, char colors } break; case 2: - for (i = ibuf->x * ibuf->y; i > 0; i--) { + for (size_t i = (size_t)ibuf->x * (size_t)ibuf->y; i > 0; i--) { to[0] = to[1] = to[2] = from[0]; to[3] = from[1]; to += 4; from += 2; } break; case 1: - for (i = ibuf->x * ibuf->y; i > 0; i--) { + for (size_t i = (size_t)ibuf->x * (size_t)ibuf->y; i > 0; i--) { to[0] = to[1] = to[2] = from[0]; to[3] = 0xff; to += 4; from++; @@ -759,7 +759,7 @@ ImBuf *imb_loadpng(const unsigned char *mem, size_t size, int flags, char colors if (flags & IB_metadata) { png_text *text_chunks; int count = png_get_text(png_ptr, info_ptr, &text_chunks, NULL); - for (i = 0; i < count; i++) { + for (int i = 0; i < count; i++) { IMB_metadata_add_field(ibuf, text_chunks[i].key, text_chunks[i].text); ibuf->flags |= IB_metadata; } diff --git a/source/blender/imbuf/intern/radiance_hdr.c b/source/blender/imbuf/intern/radiance_hdr.c index a21468e474c..8d822a314f5 100644 --- a/source/blender/imbuf/intern/radiance_hdr.c +++ b/source/blender/imbuf/intern/radiance_hdr.c @@ -71,7 +71,7 @@ typedef float fCOLOR[3]; /* read routines */ static const unsigned char *oldreadcolrs(RGBE *scan, const unsigned char *mem, int xmax, const unsigned char *mem_eof) { - int i, rshift = 0, len = xmax; + size_t i, rshift = 0, len = xmax; while (len > 0) { if (UNLIKELY(mem_eof - mem < 4)) { return NULL; @@ -99,8 +99,6 @@ static const unsigned char *oldreadcolrs(RGBE *scan, const unsigned char *mem, i static const unsigned char *freadcolrs(RGBE *scan, const unsigned char *mem, int xmax, const unsigned char *mem_eof) { - int i, j, code, val; - if (UNLIKELY(mem_eof - mem < 4)) { return NULL; } @@ -109,32 +107,32 @@ static const unsigned char *freadcolrs(RGBE *scan, const unsigned char *mem, int return oldreadcolrs(scan, mem, xmax, mem_eof); } - i = *mem++; - if (i != 2) { + int val = *mem++; + if (val != 2) { return oldreadcolrs(scan, mem - 1, xmax, mem_eof); } scan[0][GRN] = *mem++; scan[0][BLU] = *mem++; - i = *mem++; + val = *mem++; if (scan[0][GRN] != 2 || scan[0][BLU] & 128) { scan[0][RED] = 2; - scan[0][EXP] = i; + scan[0][EXP] = val; return oldreadcolrs(scan + 1, mem, xmax - 1, mem_eof); } - if (UNLIKELY(((scan[0][BLU] << 8) | i) != xmax)) { + if (UNLIKELY(((scan[0][BLU] << 8) | val) != xmax)) { return NULL; } - for (i = 0; i < 4; i++) { + for (size_t i = 0; i < 4; i++) { if (UNLIKELY(mem_eof - mem < 2)) { return NULL; } - for (j = 0; j < xmax; ) { - code = *mem++; + for (size_t j = 0; j < xmax; ) { + int code = *mem++; if (code > 128) { code &= 127; if (UNLIKELY(code + j > xmax)) { @@ -215,7 +213,6 @@ struct ImBuf *imb_loadhdr(const unsigned char *mem, size_t size, int flags, char float *rect_float; int found = 0; int width = 0, height = 0; - int x, y; const unsigned char *ptr, *mem_eof = mem + size; char oriY[80], oriX[80]; @@ -223,6 +220,7 @@ struct ImBuf *imb_loadhdr(const unsigned char *mem, size_t size, int flags, char colorspace_set_default_role(colorspace, IM_MAX_SPACE, COLOR_ROLE_DEFAULT_FLOAT); /* find empty line, next line is resolution info */ + size_t x; for (x = 1; x < size; x++) { if ((mem[x - 1] == '\n') && (mem[x] == '\n')) { found = 1; @@ -259,7 +257,7 @@ struct ImBuf *imb_loadhdr(const unsigned char *mem, size_t size, int flags, char sline = (RGBE *)MEM_mallocN(sizeof(*sline) * width, __func__); rect_float = ibuf->rect_float; - for (y = 0; y < height; y++) { + for (size_t y = 0; y < height; y++) { ptr = freadcolrs(sline, ptr, width, mem_eof); if (ptr == NULL) { printf("WARNING! HDR decode error, image may be just truncated, or completely wrong...\n"); @@ -293,7 +291,7 @@ struct ImBuf *imb_loadhdr(const unsigned char *mem, size_t size, int flags, char /* ImBuf write */ static int fwritecolrs(FILE *file, int width, int channels, unsigned char *ibufscan, float *fpscan) { - int x, i, j, beg, c2, cnt = 0; + int beg, c2, cnt = 0; fCOLOR fcol; RGBE rgbe, *rgbe_scan; @@ -304,8 +302,7 @@ static int fwritecolrs(FILE *file, int width, int channels, unsigned char *ibufs rgbe_scan = (RGBE *)MEM_mallocN(sizeof(RGBE) * width, "radhdr_write_tmpscan"); /* convert scanline */ - j = 0; - for (i = 0; i < width; i++) { + for (size_t i = 0, j = 0; i < width; i++) { if (fpscan) { fcol[RED] = fpscan[j]; fcol[GRN] = (channels >= 2) ? fpscan[j + 1] : fpscan[j]; @@ -322,7 +319,7 @@ static int fwritecolrs(FILE *file, int width, int channels, unsigned char *ibufs } if ((width < MINELEN) | (width > MAXELEN)) { /* OOBs, write out flat */ - x = fwrite((char *)rgbe_scan, sizeof(RGBE), width, file) - width; + int x = fwrite((char *)rgbe_scan, sizeof(RGBE), width, file) - width; MEM_freeN(rgbe_scan); return x; } @@ -332,8 +329,8 @@ static int fwritecolrs(FILE *file, int width, int channels, unsigned char *ibufs putc((unsigned char)(width >> 8), file); putc((unsigned char)(width & 255), file); /* put components separately */ - for (i = 0; i < 4; i++) { - for (j = 0; j < width; j += cnt) { /* find next run */ + for (size_t i = 0; i < 4; i++) { + for (size_t j = 0; j < width; j += cnt) { /* find next run */ for (beg = j; beg < width; beg += cnt) { for (cnt = 1; (cnt < 127) && ((beg + cnt) < width) && (rgbe_scan[beg + cnt][i] == rgbe_scan[beg][i]); cnt++) ; if (cnt >= MINRUN) break; /* long enough */ @@ -386,7 +383,7 @@ int imb_savehdr(struct ImBuf *ibuf, const char *name, int flags) { FILE *file = BLI_fopen(name, "wb"); float *fp = NULL; - int y, width = ibuf->x, height = ibuf->y; + size_t width = ibuf->x, height = ibuf->y; unsigned char *cp = NULL; (void)flags; /* unused */ @@ -402,7 +399,7 @@ int imb_savehdr(struct ImBuf *ibuf, const char *name, int flags) if (ibuf->rect_float) fp = ibuf->rect_float + ibuf->channels * (height - 1) * width; - for (y = height - 1; y >= 0; y--) { + for (size_t y = 0; y < height; y++) { if (fwritecolrs(file, width, ibuf->channels, cp, fp) < 0) { fclose(file); printf("HDR write error\n"); diff --git a/source/blender/imbuf/intern/tiff.c b/source/blender/imbuf/intern/tiff.c index 98aa7c5353b..afd28bb570b 100644 --- a/source/blender/imbuf/intern/tiff.c +++ b/source/blender/imbuf/intern/tiff.c @@ -376,7 +376,7 @@ static void imb_read_tiff_resolution(ImBuf *ibuf, TIFF *image) */ static int imb_read_tiff_pixels(ImBuf *ibuf, TIFF *image) { - ImBuf *tmpibuf; + ImBuf *tmpibuf = NULL; int success = 0; short bitspersample, spp, config; size_t scanline; @@ -412,16 +412,25 @@ static int imb_read_tiff_pixels(ImBuf *ibuf, TIFF *image) if (bitspersample == 32) { ib_flag = IB_rectfloat; fbuf = (float *)_TIFFmalloc(scanline); + if (!fbuf) { + goto cleanup; + } } else if (bitspersample == 16) { ib_flag = IB_rectfloat; sbuf = (unsigned short *)_TIFFmalloc(scanline); + if (!sbuf) { + goto cleanup; + } } else { ib_flag = IB_rect; } tmpibuf = IMB_allocImBuf(ibuf->x, ibuf->y, ibuf->planes, ib_flag); + if (!tmpibuf) { + goto cleanup; + } /* simple RGBA image */ if (!(bitspersample == 32 || bitspersample == 16)) { @@ -430,7 +439,7 @@ static int imb_read_tiff_pixels(ImBuf *ibuf, TIFF *image) /* contiguous channels: RGBRGBRGB */ else if (config == PLANARCONFIG_CONTIG) { for (row = 0; row < ibuf->y; row++) { - int ib_offset = ibuf->x * ibuf->y * 4 - ibuf->x * 4 * (row + 1); + size_t ib_offset = (size_t)ibuf->x * 4 * ((size_t)ibuf->y - ((size_t)row + 1)); if (bitspersample == 32) { success |= TIFFReadScanline(image, fbuf, row, 0); @@ -450,7 +459,7 @@ static int imb_read_tiff_pixels(ImBuf *ibuf, TIFF *image) * but only fill in from the TIFF scanline where necessary. */ for (chan = 0; chan < 4; chan++) { for (row = 0; row < ibuf->y; row++) { - int ib_offset = ibuf->x * ibuf->y * 4 - ibuf->x * 4 * (row + 1); + size_t ib_offset = (size_t)ibuf->x * 4 * ((size_t)ibuf->y - ((size_t)row + 1)); if (bitspersample == 32) { if (chan == 3 && spp == 3) /* fill alpha if only RGB TIFF */ @@ -475,11 +484,6 @@ static int imb_read_tiff_pixels(ImBuf *ibuf, TIFF *image) } } } - - if (bitspersample == 32) - _TIFFfree(fbuf); - else if (bitspersample == 16) - _TIFFfree(sbuf); if (success) { /* Code seems to be not needed for 16 bits tif, on PPC G5 OSX (ton) */ @@ -498,6 +502,12 @@ static int imb_read_tiff_pixels(ImBuf *ibuf, TIFF *image) tmpibuf->mall &= ~ib_flag; } +cleanup: + if (bitspersample == 32) + _TIFFfree(fbuf); + else if (bitspersample == 16) + _TIFFfree(sbuf); + IMB_freeImBuf(tmpibuf); return success; |