OpenEXR/CVE-2021-3477.patch

26 lines
1.1 KiB
Diff

From 467be80b75642efbbe6bdace558079f68c16acb1 Mon Sep 17 00:00:00 2001
From: peterhillman <peterh@wetafx.co.nz>
Date: Tue, 10 Nov 2020 08:35:59 +1300
Subject: [PATCH] Fix overflow computing deeptile sample table size (#861)
Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>
---
IlmImf/ImfDeepTiledInputFile.cpp | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/IlmImf/ImfDeepTiledInputFile.cpp b/IlmImf/ImfDeepTiledInputFile.cpp
index 0f893481b..f5abe9c6a 100644
--- a/IlmImf/ImfDeepTiledInputFile.cpp
+++ b/IlmImf/ImfDeepTiledInputFile.cpp
@@ -1034,8 +1034,8 @@ DeepTiledInputFile::initialize ()
for (size_t i = 0; i < _data->tileBuffers.size(); i++)
_data->tileBuffers[i] = new TileBuffer ();
- _data->maxSampleCountTableSize = _data->tileDesc.ySize *
- _data->tileDesc.xSize *
+ _data->maxSampleCountTableSize = static_cast<size_t>(_data->tileDesc.ySize) *
+ static_cast<size_t>(_data->tileDesc.xSize) *
sizeof(int);
_data->sampleCountTableBuffer.resizeErase(_data->maxSampleCountTableSize);