PPM TGA HDR bounds updates on readers (#421)

This commit is contained in:
Chuck Walbourn
2023-12-12 13:17:51 -08:00
committed by GitHub
parent 0f8b427bf4
commit 3154a66b41
6 changed files with 38 additions and 28 deletions

View File

@@ -157,7 +157,7 @@ HRESULT __cdecl LoadFromPortablePixMap(
if (ppmSize < 3)
return E_FAIL;
if (ppmData[0] != 'P' || (ppmData[1] != '3' && ppmData[1] != '6'))
if (ppmData[0] != 'P' || (ppmData[1] != '3' && ppmData[1] != '6') || !isspace(ppmData[2]))
return E_FAIL;
const bool ascii = ppmData[1] == '3';
@@ -280,10 +280,10 @@ HRESULT __cdecl LoadFromPortablePixMap(
return HRESULT_FROM_WIN32(ERROR_NOT_SUPPORTED);
}
uint64_t sizeBytes = uint64_t(width) * uint64_t(u);
uint64_t sizeBytes = uint64_t(width) * uint64_t(u) * 4;
if (sizeBytes > UINT32_MAX)
{
HRESULT_FROM_WIN32(ERROR_ARITHMETIC_OVERFLOW);
return HRESULT_FROM_WIN32(ERROR_ARITHMETIC_OVERFLOW);
}
if (metadata)
@@ -454,18 +454,19 @@ HRESULT __cdecl LoadFromPortablePixMapHDR(
if (pfmSize < 3)
return E_FAIL;
if (pfmData[0] != 'P' || pfmData[2] != '\n')
if (pfmData[0] != 'P' || !isspace(pfmData[2]))
return E_FAIL;
DXGI_FORMAT format = DXGI_FORMAT_UNKNOWN;
bool monochrome = false;
bool half16 = false;
unsigned int bpp = 0;
switch (pfmData[1])
{
case 'f': format = DXGI_FORMAT_R32_FLOAT; monochrome = true; break;
case 'F': format = DXGI_FORMAT_R32G32B32A32_FLOAT; break;
case 'h': format = DXGI_FORMAT_R16_FLOAT; monochrome = true; half16 = true; break;
case 'H': format = DXGI_FORMAT_R16G16B16A16_FLOAT; half16 = true; break;
case 'f': format = DXGI_FORMAT_R32_FLOAT; monochrome = true; bpp = 4u; break;
case 'F': format = DXGI_FORMAT_R32G32B32A32_FLOAT; bpp = 16u; break;
case 'h': format = DXGI_FORMAT_R16_FLOAT; monochrome = true; half16 = true; bpp = 2u; break;
case 'H': format = DXGI_FORMAT_R16G16B16A16_FLOAT; half16 = true; bpp = 8u; break;
default:
return E_FAIL;
}
@@ -509,10 +510,10 @@ HRESULT __cdecl LoadFromPortablePixMapHDR(
return HRESULT_FROM_WIN32(ERROR_NOT_SUPPORTED);
}
uint64_t sizeBytes = uint64_t(width) * uint64_t(height);
uint64_t sizeBytes = uint64_t(width) * uint64_t(height) * bpp;
if (sizeBytes > UINT32_MAX)
{
HRESULT_FROM_WIN32(ERROR_ARITHMETIC_OVERFLOW);
return HRESULT_FROM_WIN32(ERROR_ARITHMETIC_OVERFLOW);
}
pData += len + 1;