From 37e799e299d52f57b638463c51cfbeaf8de820a6 Mon Sep 17 00:00:00 2001
From: Jeroen Bakker <jeroen@blender.org>
Date: Fri, 10 Dec 2021 12:27:55 +0100
Subject: Fix crash using 32k images.

Use IMB_get_rect_len to solve overflow issues.
---
 source/blender/imbuf/intern/divers.c       | 19 ++++++++-----------
 source/blender/imbuf/intern/imageprocess.c |  4 ++--
 2 files changed, 10 insertions(+), 13 deletions(-)

(limited to 'source/blender')

diff --git a/source/blender/imbuf/intern/divers.c b/source/blender/imbuf/intern/divers.c
index 1d0839b502b..4841f7b5039 100644
--- a/source/blender/imbuf/intern/divers.c
+++ b/source/blender/imbuf/intern/divers.c
@@ -382,7 +382,7 @@ void IMB_buffer_float_from_byte(float *rect_to,
 
   /* RGBA input */
   for (y = 0; y < height; y++) {
-    const uchar *from = rect_from + stride_from * y * 4;
+    const uchar *from = rect_from + ((size_t)stride_from) * y * 4;
     float *to = rect_to + ((size_t)stride_to) * y * 4;
 
     if (profile_to == profile_from) {
@@ -784,17 +784,14 @@ void IMB_float_from_rect(ImBuf *ibuf)
    */
   rect_float = ibuf->rect_float;
   if (rect_float == NULL) {
-    size_t size;
-
-    size = ((size_t)ibuf->x) * ibuf->y;
-    size = sizeof(float[4]) * size;
-    ibuf->channels = 4;
-
+    const size_t size = IMB_get_rect_len(ibuf) * sizeof(float[4]);
     rect_float = MEM_callocN(size, "IMB_float_from_rect");
 
     if (rect_float == NULL) {
       return;
     }
+
+    ibuf->channels = 4;
   }
 
   /* first, create float buffer in non-linear space */
@@ -837,13 +834,13 @@ void IMB_color_to_bw(ImBuf *ibuf)
   size_t i;
 
   if (rct_fl) {
-    for (i = ((size_t)ibuf->x) * ibuf->y; i > 0; i--, rct_fl += 4) {
+    for (i = IMB_get_rect_len(ibuf); i > 0; i--, rct_fl += 4) {
       rct_fl[0] = rct_fl[1] = rct_fl[2] = IMB_colormanagement_get_luminance(rct_fl);
     }
   }
 
   if (rct) {
-    for (i = ((size_t)ibuf->x * ibuf->y); i > 0; i--, rct += 4) {
+    for (i = IMB_get_rect_len(ibuf); i > 0; i--, rct += 4) {
       rct[0] = rct[1] = rct[2] = IMB_colormanagement_get_luminance_byte(rct);
     }
   }
@@ -884,7 +881,7 @@ void IMB_saturation(ImBuf *ibuf, float sat)
 
   if (rct) {
     float rgb[3];
-    for (i = ((size_t)ibuf->x) * ibuf->y; i > 0; i--, rct += 4) {
+    for (i = IMB_get_rect_len(ibuf); i > 0; i--, rct += 4) {
       rgb_uchar_to_float(rgb, rct);
       rgb_to_hsv_v(rgb, hsv);
       hsv_to_rgb(hsv[0], hsv[1] * sat, hsv[2], rgb, rgb + 1, rgb + 2);
@@ -893,7 +890,7 @@ void IMB_saturation(ImBuf *ibuf, float sat)
   }
 
   if (rct_fl) {
-    for (i = ((size_t)ibuf->x) * ibuf->y; i > 0; i--, rct_fl += 4) {
+    for (i = IMB_get_rect_len(ibuf); i > 0; i--, rct_fl += 4) {
       rgb_to_hsv_v(rct_fl, hsv);
       hsv_to_rgb(hsv[0], hsv[1] * sat, hsv[2], rct_fl, rct_fl + 1, rct_fl + 2);
     }
diff --git a/source/blender/imbuf/intern/imageprocess.c b/source/blender/imbuf/intern/imageprocess.c
index 450067f6c6c..1babc3d3b3e 100644
--- a/source/blender/imbuf/intern/imageprocess.c
+++ b/source/blender/imbuf/intern/imageprocess.c
@@ -264,7 +264,7 @@ void nearest_interpolation_color_char(
     return;
   }
 
-  const size_t offset = (in->x * y1 + x1) * 4;
+  const size_t offset = ((size_t)in->x * y1 + x1) * 4;
   const unsigned char *dataI = (unsigned char *)in->rect + offset;
   outI[0] = dataI[0];
   outI[1] = dataI[1];
@@ -287,7 +287,7 @@ void nearest_interpolation_color_fl(
     return;
   }
 
-  const size_t offset = (in->x * y1 + x1) * 4;
+  const size_t offset = ((size_t)in->x * y1 + x1) * 4;
   const float *dataF = in->rect_float + offset;
   copy_v4_v4(outF, dataF);
 }
-- 
cgit v1.2.3