OpenEXR/CVE-2021-3478.patch

36 lines
1.7 KiB
Diff

From bc88cdb6c97fbf5bc5d11ad8ca55306da931283a Mon Sep 17 00:00:00 2001
From: peterhillman <peterh@wetafx.co.nz>
Date: Fri, 20 Nov 2020 08:30:08 +1300
Subject: [PATCH] sanity check ScanlineInput bytesPerLine instead of lineOffset
size (#863)
Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>
Co-authored-by: Cary Phillips <cary@ilm.com>
---
IlmImf/ImfScanLineInputFile.cpp | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/IlmImf/ImfScanLineInputFile.cpp b/IlmImf/ImfScanLineInputFile.cpp
index 649fc304b..54caec01d 100644
--- a/IlmImf/ImfScanLineInputFile.cpp
+++ b/IlmImf/ImfScanLineInputFile.cpp
@@ -1135,14 +1135,14 @@ void ScanLineInputFile::initialize(const Header& header)
_data->linesInBuffer) / _data->linesInBuffer;
//
- // avoid allocating excessive memory due to large lineOffsets table size.
+ // avoid allocating excessive memory due to large lineOffsets and bytesPerLine table sizes.
// If the chunktablesize claims to be large,
- // check the file is big enough to contain the table before allocating memory
+ // check the file is big enough to contain the lineOffsets table before allocating memory
// in the bytesPerLineTable and the lineOffsets table.
// Attempt to read the last entry in the table. Either the seekg() or the read()
// call will throw an exception if the file is too small to contain the table
//
- if (lineOffsetSize > gLargeChunkTableSize)
+ if (lineOffsetSize * _data->linesInBuffer > gLargeChunkTableSize)
{
Int64 pos = _streamData->is->tellg();
_streamData->is->seekg(pos + (lineOffsetSize-1)*sizeof(Int64));