From 01af47929f97bedf2269b657a43c04c419452eee Mon Sep 17 00:00:00 2001 From: Peter Hillman Date: Mon, 20 Sep 2021 10:09:35 +1200 Subject: [PATCH 1/2] prevent overflow in bytesPerDeepLineTable Signed-off-by: Peter Hillman --- src/lib/OpenEXR/ImfMisc.cpp | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/src/lib/OpenEXR/ImfMisc.cpp b/src/lib/OpenEXR/ImfMisc.cpp index 80c8ce8d25..554a91c53e 100644 --- a/src/lib/OpenEXR/ImfMisc.cpp +++ b/src/lib/OpenEXR/ImfMisc.cpp @@ -131,7 +131,7 @@ bytesPerDeepLineTable (const Header &header, { const int ySampling = abs(c.channel().ySampling); const int xSampling = abs(c.channel().xSampling); - const int pixelSize = pixelTypeSize (c.channel().type); + uint64_t pixelSize = pixelTypeSize (c.channel().type); // Here we transform from the domain over all pixels into the domain // of actual samples. We want to sample points in [minY, maxY] where @@ -148,12 +148,22 @@ bytesPerDeepLineTable (const Header &header, for (int y = sampleMinY; y <= sampleMaxY; y+=ySampling) { - int nBytes = 0; + uint64_t nBytes = 0; for (int x = sampleMinX; x <= sampleMaxX; x += xSampling) { nBytes += pixelSize * - sampleCount(base, xStride, yStride, x, y); + static_cast(sampleCount(base, xStride, yStride, x, y)); } + + // + // architectures where size_t is smaller than 64 bits may overflow + // (scanlines with more than 2^32 bytes are not currently supported so this should not occur with valid files) + // + if( static_cast(bytesPerLine[y - dataWindow.min.y]) + nBytes > SIZE_MAX) + { + throw IEX_NAMESPACE::IoExc("Scanline size too large"); + } + bytesPerLine[y - dataWindow.min.y] += nBytes; } } @@ -161,8 +171,12 @@ bytesPerDeepLineTable (const Header &header, size_t maxBytesPerLine = 0; for (int y = minY; y <= maxY; ++y) + { if (maxBytesPerLine < bytesPerLine[y - dataWindow.min.y]) + { maxBytesPerLine = bytesPerLine[y - dataWindow.min.y]; + } + } return maxBytesPerLine; } From c6b2376525d06e6d98e90ca65eacbe65686b5524 Mon Sep 17 00:00:00 2001 From: Peter Hillman Date: Mon, 20 Sep 2021 17:43:52 +1200 Subject: [PATCH 2/2] restore zapped 'const' from ImfMisc Signed-off-by: Peter Hillman --- src/lib/OpenEXR/ImfMisc.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/lib/OpenEXR/ImfMisc.cpp b/src/lib/OpenEXR/ImfMisc.cpp index 554a91c53e..844890910f 100644 --- a/src/lib/OpenEXR/ImfMisc.cpp +++ b/src/lib/OpenEXR/ImfMisc.cpp @@ -131,7 +131,7 @@ bytesPerDeepLineTable (const Header &header, { const int ySampling = abs(c.channel().ySampling); const int xSampling = abs(c.channel().xSampling); - uint64_t pixelSize = pixelTypeSize (c.channel().type); + const uint64_t pixelSize = pixelTypeSize (c.channel().type); // Here we transform from the domain over all pixels into the domain // of actual samples. We want to sample points in [minY, maxY] where