griefith/test
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Fix: Safely handle >4 channel float images inside IMB_dupImBuf

Browse Source 
While investigating #124217 it was noticed that sometimes a >4 channel
ImBuf might be passed through to this api.

This would cause memory to be overwritten because the destination ImBuf
was created with only 4 channels of memory. Now we create it with the
proper number of channels.

Pull Request: https://projects.blender.org/blender/blender/pulls/124472
This commit is contained in:
Jesse Yurkovich
2024-07-11 17:44:09 +02:00
committed by Jesse Yurkovich
parent 7a076d26a6
commit af85fd3b22
1 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
source/blender/imbuf/intern/allocimbuf.cc
View File

@@ -635,9 +635,6 @@ ImBuf *IMB_dupImBuf(const ImBuf *ibuf1)
if (ibuf1->byte_buffer.data) {
flags |= IB_rect;
}
if (ibuf1->float_buffer.data) {
flags |= IB_rectfloat;
}
x = ibuf1->x;
y = ibuf1->y;
@@ -651,10 +648,18 @@ ImBuf *IMB_dupImBuf(const ImBuf *ibuf1)
memcpy(ibuf2->byte_buffer.data, ibuf1->byte_buffer.data, size_t(x) * y * 4 * sizeof(uint8_t));
}
if (flags & IB_rectfloat) {
if (ibuf1->float_buffer.data) {
/* Ensure the correct number of channels are being allocated for the new ImBuf. Some
* compositing scenarios might end up with >4 channels and we want to duplicate them prooperly.
*/
if (imb_addrectfloatImBuf(ibuf2, ibuf1->channels, false) == false) {
IMB_freeImBuf(ibuf2);
return nullptr;
}
memcpy(ibuf2->float_buffer.data,
ibuf1->float_buffer.data,
size_t(ibuf1->channels) * x * y * sizeof(float));
size_t(ibuf2->channels) * x * y * sizeof(float));
}
if (ibuf1->encoded_buffer.data) {