OpenEXR/CVE-2021-20296.patch

27 lines
945 B
Diff

From 64ed1789afb3286cdb638bf34676f7d770032a84 Mon Sep 17 00:00:00 2001
From: wang_yue111 <648774160@qq.com>
Date: Tue, 6 Apr 2021 10:24:35 +0800
Subject: [PATCH] double-check unpackedBuffer created in DWA uncompress
Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>
---
IlmImf/ImfDwaCompressor.cpp | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/IlmImf/ImfDwaCompressor.cpp b/IlmImf/ImfDwaCompressor.cpp
index 2ef8878..c6518bb 100644
--- a/IlmImf/ImfDwaCompressor.cpp
+++ b/IlmImf/ImfDwaCompressor.cpp
@@ -2524,7 +2524,7 @@ DwaCompressor::uncompress
if (acCompressedSize > 0)
{
- if (totalAcUncompressedCount*sizeof(unsigned short) > _packedAcBufferSize)
+ if ( !_packedAcBuffer || totalAcUncompressedCount*sizeof(unsigned short) > _packedAcBufferSize)
{
throw Iex::InputExc("Error uncompressing DWA data"
"(corrupt header).");
--
2.23.0