blender
/
blender
128
396
Fork 568
Code Issues 6.2k Pull Requests 750 Projects 19 Wiki Activity

Fix T86952: Buffer overflow reading specific DDS images 

Add a data boundary check in the flipping code.

This code now also communicates the number of mipmap levels
it processed with an intent to avoid GPU texture from using
more levels than there are in the DDS data.

Differential Revision: https://developer.blender.org/D13755
This commit is contained in:
Sergey Sharybin 2022-01-06 16:08:40 +01:00 committed by Philipp Oeser
parent e07f16776b
commit d294d19d21
Notes: blender-bot 2023-02-14 03:03:03 +01:00 
Referenced by issue #88449: Blender LTS: Maintenance Task 2.93
Referenced by issue #88449, Blender LTS: Maintenance Task 2.93
Referenced by issue #86952, Heap Buffer Overflow when viewing dds thumbnails in the file browser.
3 changed files with 39 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
source/blender/imbuf/intern/dds/FlipDXT.cpp
View File

@ -168,10 +168,16 @@ static void FlipDXT5BlockHalf(uint8_t *block)
FlipDXT1BlockHalf(block + 8);
}
/* Flips a DXTC image, by flipping and swapping DXTC blocks as appropriate. */
int FlipDXTCImage(
unsigned int width, unsigned int height, unsigned int levels, int fourcc, uint8_t *data)
int FlipDXTCImage(unsigned int width,
unsigned int height,
unsigned int levels,
int fourcc,
uint8_t *data,
int data_size,
unsigned int *r_num_valid_levels)
{
*r_num_valid_levels = 0;
/* Must have valid dimensions. */
if (width == 0 || height == 0) {
return 0;
@ -205,14 +211,25 @@ int FlipDXTCImage(
return 0;
}
*r_num_valid_levels = levels;
unsigned int mip_width = width;
unsigned int mip_height = height;
const uint8_t *data_end = data + data_size;
for (unsigned int i = 0; i < levels; i++) {
unsigned int blocks_per_row = (mip_width + 3) / 4;
unsigned int blocks_per_col = (mip_height + 3) / 4;
unsigned int blocks = blocks_per_row * blocks_per_col;
if (data + block_bytes * blocks > data_end) {
/* Stop flipping when running out of data to be modified, avoiding possible buffer overrun
* on a malformed files. */
*r_num_valid_levels = i;
break;
}
if (mip_height == 1) {
/* no flip to do, and we're done. */
break;

15
source/blender/imbuf/intern/dds/FlipDXT.h
View File

@ -18,6 +18,15 @@
#include "BLI_sys_types.h"
/* flip compressed DXT image vertically to fit OpenGL convention */
int FlipDXTCImage(
unsigned int width, unsigned int height, unsigned int levels, int fourcc, uint8_t *data);
/**
* Flips a DXTC image, by flipping and swapping DXTC blocks as appropriate.
*
* Use to flip vertically to fit OpenGL convention.
*/
int FlipDXTCImage(unsigned int width,
unsigned int height,
unsigned int levels,
int fourcc,
uint8_t *data,
int data_size,
unsigned int *r_num_valid_levels);

9
source/blender/imbuf/intern/dds/dds_api.cpp
View File

@ -186,8 +186,13 @@ struct ImBuf *imb_load_dds(const unsigned char *mem,
/* flip compressed texture */
if (ibuf->dds_data.data) {
FlipDXTCImage(
dds.width(), dds.height(), dds.mipmapCount(), dds.fourCC(), ibuf->dds_data.data);
FlipDXTCImage(dds.width(),
dds.height(),
ibuf->dds_data.nummipmaps,
dds.fourCC(),
ibuf->dds_data.data,
ibuf->dds_data.size,
&ibuf->dds_data.nummipmaps);
}
}
else {