Fix #129691: heap buffer overflow when writing unaligned data to .blend file
`writedata` used to align the written buffer size to a multiple of 4. This causes multiple issues: * Writes uninitialized data. * Crash with ASAN due to a heap buffer overflow if the buffer is not any longer than what is passed in. * Modifies the length of the buffer which can't be undone when reading the buffer again. I don't know of any reason for this alignment here. I'd think that it doesn't matter when writing to a file. If it would matter, then we should probably align to at least 8 nowadays because that's the alignment of pointers. The original reason for this alignment seems to be lost to history. It was already part of the initial commit. Pull Request: https://projects.blender.org/blender/blender/pulls/129821
This commit is contained in:
@@ -771,9 +771,6 @@ static void writedata(WriteData *wd, int filecode, size_t len, const void *adr)
|
||||
return;
|
||||
}
|
||||
|
||||
/* Align to 4 (writes uninitialized bytes in some cases). */
|
||||
len = (len + 3) & ~size_t(3);
|
||||
|
||||
if (len > INT_MAX) {
|
||||
BLI_assert_msg(0, "Cannot write chunks bigger than INT_MAX.");
|
||||
return;
|
||||
|
||||
Reference in New Issue
Block a user