sergiotarxz/libvips
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

fix buffer overflow in radiance read

Browse Source 
old-style RLE images could overflow the output buffer if incorrectly coded

see https://github.com/jcupitt/libvips/issues/1039
This commit is contained in:
John Cupitt 2018-07-23 12:55:41 +01:00
parent 136c8d8cd6
commit 9fa03e80c7
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libvips/foreign/radiance.c
View File

@ -760,7 +760,8 @@ scanline_read_old( Buffer *buffer, COLR *scanline, int width )
scanline[0][BLU] == 1 ) { scanline[0][BLU] == 1 ) {
int i; int i;
for( i = scanline[0][EXP] << rshift; i > 0; i-- ) { for( i = scanline[0][EXP] << rshift;
i > 0 && width > 0; i-- ) {
copycolr( scanline[0], scanline[-1] ); copycolr( scanline[0], scanline[-1] );
scanline += 1; scanline += 1;
width -= 1; width -= 1;