blender
/
blender
136
404
Fork 586
Code Issues 6.2k Pull Requests 756 Projects 19 Wiki Activity

Fix crash using 32k images. 

Use IMB_get_rect_len to solve overflow issues.
This commit is contained in:
Jeroen Bakker 2021-12-10 12:27:55 +01:00
parent bd2b48e98d
commit 37e799e299
2 changed files with 10 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
source/blender/imbuf/intern/divers.c
View File

@ -382,7 +382,7 @@ void IMB_buffer_float_from_byte(float *rect_to,
/* RGBA input */
for (y = 0; y < height; y++) {
const uchar *from = rect_from + stride_from * y * 4;
const uchar *from = rect_from + ((size_t)stride_from) * y * 4;
float *to = rect_to + ((size_t)stride_to) * y * 4;
if (profile_to == profile_from) {
@ -784,17 +784,14 @@ void IMB_float_from_rect(ImBuf *ibuf)
*/
rect_float = ibuf->rect_float;
if (rect_float == NULL) {
size_t size;
size = ((size_t)ibuf->x) * ibuf->y;
size = sizeof(float[4]) * size;
ibuf->channels = 4;
const size_t size = IMB_get_rect_len(ibuf) * sizeof(float[4]);
rect_float = MEM_callocN(size, "IMB_float_from_rect");
if (rect_float == NULL) {
return;
}
ibuf->channels = 4;
}
/* first, create float buffer in non-linear space */
@ -837,13 +834,13 @@ void IMB_color_to_bw(ImBuf *ibuf)
size_t i;
if (rct_fl) {
for (i = ((size_t)ibuf->x) * ibuf->y; i > 0; i--, rct_fl += 4) {
for (i = IMB_get_rect_len(ibuf); i > 0; i--, rct_fl += 4) {
rct_fl[0] = rct_fl[1] = rct_fl[2] = IMB_colormanagement_get_luminance(rct_fl);
}
}
if (rct) {
for (i = ((size_t)ibuf->x * ibuf->y); i > 0; i--, rct += 4) {
for (i = IMB_get_rect_len(ibuf); i > 0; i--, rct += 4) {
rct[0] = rct[1] = rct[2] = IMB_colormanagement_get_luminance_byte(rct);
}
}
@ -884,7 +881,7 @@ void IMB_saturation(ImBuf *ibuf, float sat)
if (rct) {
float rgb[3];
for (i = ((size_t)ibuf->x) * ibuf->y; i > 0; i--, rct += 4) {
for (i = IMB_get_rect_len(ibuf); i > 0; i--, rct += 4) {
rgb_uchar_to_float(rgb, rct);
rgb_to_hsv_v(rgb, hsv);
hsv_to_rgb(hsv[0], hsv[1] * sat, hsv[2], rgb, rgb + 1, rgb + 2);
@ -893,7 +890,7 @@ void IMB_saturation(ImBuf *ibuf, float sat)
}
if (rct_fl) {
for (i = ((size_t)ibuf->x) * ibuf->y; i > 0; i--, rct_fl += 4) {
for (i = IMB_get_rect_len(ibuf); i > 0; i--, rct_fl += 4) {
rgb_to_hsv_v(rct_fl, hsv);
hsv_to_rgb(hsv[0], hsv[1] * sat, hsv[2], rct_fl, rct_fl + 1, rct_fl + 2);
}

4
source/blender/imbuf/intern/imageprocess.c
View File

@ -264,7 +264,7 @@ void nearest_interpolation_color_char(
return;
}
const size_t offset = (in->x * y1 + x1) * 4;
const size_t offset = ((size_t)in->x * y1 + x1) * 4;
const unsigned char *dataI = (unsigned char *)in->rect + offset;
outI[0] = dataI[0];
outI[1] = dataI[1];
@ -287,7 +287,7 @@ void nearest_interpolation_color_fl(
return;
}
const size_t offset = (in->x * y1 + x1) * 4;
const size_t offset = ((size_t)in->x * y1 + x1) * 4;
const float *dataF = in->rect_float + offset;
copy_v4_v4(outF, dataF);
}