OpenEXR/CVE-2021-23215.patch
2021-06-22 15:26:04 +08:00

84 lines
3.1 KiB
Diff

From 1f7cac0d1538544d3f93353bc16750374aea33b8 Mon Sep 17 00:00:00 2001
From: jackie_wu <wutao61@huawei.com>
Date: Fri, 18 Jun 2021 16:31:51 +0800
Subject: [PATCH] add
---
IlmImf/ImfDwaCompressor.cpp | 21 ++++++++++-----------
1 file changed, 10 insertions(+), 11 deletions(-)
diff --git a/IlmImf/ImfDwaCompressor.cpp b/IlmImf/ImfDwaCompressor.cpp
index 1c1bd45..424cc46 100644
--- a/IlmImf/ImfDwaCompressor.cpp
+++ b/IlmImf/ImfDwaCompressor.cpp
@@ -2905,8 +2905,8 @@ DwaCompressor::initializeBuffers (size_t &outBufferSize)
int maxOutBufferSize = 0;
int numLossyDctChans = 0;
- int unknownBufferSize = 0;
- int rleBufferSize = 0;
+ size_t unknownBufferSize = 0;
+ size_t rleBufferSize = 0;
int maxLossyDctAcSize = (int)ceil ((float)numScanLines() / 8.0f) *
(int)ceil ((float)(_max[0] - _min[0] + 1) / 8.0f) *
@@ -2916,6 +2916,9 @@ DwaCompressor::initializeBuffers (size_t &outBufferSize)
(int)ceil ((float)(_max[0] - _min[0] + 1) / 8.0f) *
sizeof (unsigned short);
+
+ size_t pixelCount = static_cast<size_t>(numScanLines()) * static_cast<size_t>(_max[0] - _min[0] + 1);
+
for (unsigned int chan = 0; chan < _channelData.size(); ++chan)
{
switch (_channelData[chan].compression)
@@ -2939,8 +2942,7 @@ DwaCompressor::initializeBuffers (size_t &outBufferSize)
// of the source data.
//
- int rleAmount = 2 * numScanLines() * (_max[0] - _min[0] + 1) *
- Imf::pixelTypeSize (_channelData[chan].type);
+ size_t rleAmount = 2 * pixelCount * Imf::pixelTypeSize (_channelData[chan].type);
rleBufferSize += rleAmount;
}
@@ -2949,8 +2951,7 @@ DwaCompressor::initializeBuffers (size_t &outBufferSize)
case UNKNOWN:
- unknownBufferSize += numScanLines() * (_max[0] - _min[0] + 1) *
- Imf::pixelTypeSize (_channelData[chan].type);
+ unknownBufferSize += pixelCount * Imf::pixelTypeSize (_channelData[chan].type);
break;
default:
@@ -3059,7 +3060,7 @@ DwaCompressor::initializeBuffers (size_t &outBufferSize)
// all in one swoop (for each compression scheme).
//
- int planarUncBufferSize[NUM_COMPRESSOR_SCHEMES];
+ size_t planarUncBufferSize[NUM_COMPRESSOR_SCHEMES];
for (int i=0; i<NUM_COMPRESSOR_SCHEMES; ++i)
planarUncBufferSize[i] = 0;
@@ -3071,14 +3072,12 @@ DwaCompressor::initializeBuffers (size_t &outBufferSize)
break;
case RLE:
- planarUncBufferSize[RLE] +=
- numScanLines() * (_max[0] - _min[0] + 1) *
+ planarUncBufferSize[RLE] += pixelCount *
Imf::pixelTypeSize (_channelData[chan].type);
break;
case UNKNOWN:
- planarUncBufferSize[UNKNOWN] +=
- numScanLines() * (_max[0] - _min[0] + 1) *
+ planarUncBufferSize[UNKNOWN] += pixelCount *
Imf::pixelTypeSize (_channelData[chan].type);
break;
--
2.23.0