Skip to content

Commit 416fecf

Browse files
authored
Fix integer overflow in internal_dwa_compressor.h (AcademySoftwareFoundation#2346)
`width` and `height` are `int32_t`; cast to `size_t`, since the result is a pointer offset, to avoid overflow. Signed-off-by: Cary Phillips <cary@ilm.com>
1 parent aaaa7b2 commit 416fecf

1 file changed

Lines changed: 4 additions & 3 deletions

File tree

src/lib/OpenEXRCore/internal_dwa_compressor.h

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1037,7 +1037,8 @@ DwaCompressor_uncompress (
10371037
if (rv != EXR_ERR_SUCCESS) return rv;
10381038

10391039
cd->_dctData._type = chan->data_type;
1040-
outBufferEnd += chan->width * chan->bytes_per_element;
1040+
outBufferEnd +=
1041+
(size_t) chan->width * (size_t) chan->bytes_per_element;
10411042
}
10421043
}
10431044

@@ -1718,8 +1719,8 @@ DwaCompressor_setupChannelData (DwaCompressor* me)
17181719
{
17191720
for (int byte = 1; byte < curc->bytes_per_element; ++byte)
17201721
{
1721-
cd->planarUncRle[byte] =
1722-
cd->planarUncRle[byte - 1] + curc->width * curc->height;
1722+
cd->planarUncRle[byte] = cd->planarUncRle[byte - 1] +
1723+
(size_t) curc->width * (size_t) curc->height;
17231724

17241725
cd->planarUncRleEnd[byte] = cd->planarUncRle[byte];
17251726
}

0 commit comments

Comments
 (0)