blender
/
blender
129
398
Fork 572
Code Issues 6.2k Pull Requests 748 Projects 19 Wiki Activity

Fix T51609: Bake Texture, Margin crashing Blender 

Integer overflow in margin filter code.
This commit is contained in:
Sergey Sharybin 2017-05-26 11:27:27 +02:00
parent f78ba0df02
commit bf5e717ef5
Notes: blender-bot 2023-02-14 06:56:50 +01:00 
Referenced by issue #51609, Bake Texture, Margin crashing Blender
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
source/blender/imbuf/intern/filter.c
View File

@ -406,7 +406,7 @@ void IMB_filter_extend(struct ImBuf *ibuf, char *mask, int filter)
const int height = ibuf->y;
const int depth = 4; /* always 4 channels */
const int chsize = ibuf->rect_float ? sizeof(float) : sizeof(unsigned char);
const int bsize = width * height * depth * chsize;
const size_t bsize = ((size_t)width) * height * depth * chsize;
const bool is_float = (ibuf->rect_float != NULL);
void *dstbuf = (void *) MEM_dupallocN(ibuf->rect_float ? (void *) ibuf->rect_float : (void *) ibuf->rect);
char *dstmask = mask == NULL ? NULL : (char *) MEM_dupallocN(mask);
@ -499,7 +499,9 @@ void IMB_filter_extend(struct ImBuf *ibuf, char *mask, int filter)
/* keep the original buffer up to date. */
memcpy(srcbuf, dstbuf, bsize);
if (dstmask != NULL) memcpy(srcmask, dstmask, width * height);
if (dstmask != NULL) {
memcpy(srcmask, dstmask, ((size_t)width) * height);
}
}
/* free memory */