Fix: error reading RLE compressed Iris images

Regression in [0] which used a 4x large size bounds check
to prevent a buffer read overflow reading the RLE table.

[0]: 829916f4e5
This commit is contained in:
Campbell Barton
2025-04-11 15:22:17 +10:00
parent d0157b0b70
commit 2cbb07d7ad

View File

@@ -293,7 +293,7 @@ ImBuf *imb_loadiris(const uchar *mem, size_t size, int flags, ImFileColorSpace &
} \
((void)0)
MFILE_CAPACITY_AT_PTR_OK_OR_FAIL(MFILE_DATA(inf) + ((4 * 2) * tablen));
MFILE_CAPACITY_AT_PTR_OK_OR_FAIL(MFILE_DATA(inf) + (2 * tablen));
readtab(inf, starttab, tablen);
readtab(inf, lengthtab, tablen);