Yidhra/DirectXTex
2
0
Fork 0
mirror of https://github.com/microsoft/DirectXTex.git synced 2025-07-09 19:50:13 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

texconv: Updated PPM/PFM reader with explicit bounds check (#409)

Browse Source
This commit is contained in:
Chuck Walbourn 2023-11-07 14:17:32 -08:00 committed by GitHub
parent f58c30705b
commit d0bcc504eb
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 51 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
Texconv/PortablePixMap.cpp
View File

@ -194,8 +194,11 @@ HRESULT __cdecl LoadFromPortablePixMap(
if (*pData != '\n') if (*pData != '\n')
return E_FAIL; return E_FAIL;
if (ppmSize > 1)
{
pData++; pData++;
ppmSize--; ppmSize--;
}
while (ppmSize > 0 && (pixels < pixelEnd)) while (ppmSize > 0 && (pixels < pixelEnd))
{ {
@ -205,6 +208,10 @@ HRESULT __cdecl LoadFromPortablePixMap(
| 0xff000000; | 0xff000000;
pData += 3; pData += 3;
if (ppmSize < 3)
{
return HRESULT_FROM_WIN32(ERROR_HANDLE_EOF);
}
ppmSize -= 3; ppmSize -= 3;
} }
@ -254,14 +261,24 @@ HRESULT __cdecl LoadFromPortablePixMap(
if (u == 0) if (u == 0)
return E_FAIL; return E_FAIL;
if (u > INT32_MAX)
{
return HRESULT_FROM_WIN32(ERROR_FILE_TOO_LARGE);
}
width = u; width = u;
break; break;
case PPM_HEIGHT: case PPM_HEIGHT:
{ {
if (u == 0) if (u == 0 || width == 0)
return E_FAIL; return E_FAIL;
if (u > INT32_MAX)
{
return HRESULT_FROM_WIN32(ERROR_FILE_TOO_LARGE);
}
if (metadata) if (metadata)
{ {
*metadata = {}; *metadata = {};
@ -343,6 +360,11 @@ HRESULT __cdecl SaveToPortablePixMap(
return HRESULT_FROM_WIN32(ERROR_NOT_SUPPORTED); return HRESULT_FROM_WIN32(ERROR_NOT_SUPPORTED);
} }
if ((image.width > INT32_MAX) || (image.height > INT32_MAX))
{
return HRESULT_FROM_WIN32(ERROR_NOT_SUPPORTED);
}
char header[256] = {}; char header[256] = {};
const int len = sprintf_s(header, "P6\n%zu %zu\n255\n", image.width, image.height); const int len = sprintf_s(header, "P6\n%zu %zu\n255\n", image.width, image.height);
if (len == -1) if (len == -1)
@ -458,6 +480,10 @@ HRESULT __cdecl LoadFromPortablePixMapHDR(
break; break;
pData += len + 1; pData += len + 1;
if (pfmSize < (len + 1))
{
return HRESULT_FROM_WIN32(ERROR_HANDLE_EOF);
}
pfmSize -= len + 1; pfmSize -= len + 1;
if (!pfmSize) if (!pfmSize)
return E_FAIL; return E_FAIL;
@ -471,7 +497,16 @@ HRESULT __cdecl LoadFromPortablePixMapHDR(
if (sscanf_s(dataStr, "%zu %zu%s", &width, &height, junkStr, 256) != 2) if (sscanf_s(dataStr, "%zu %zu%s", &width, &height, junkStr, 256) != 2)
return E_FAIL; return E_FAIL;
if ((width > INT32_MAX) || (height > UINT32_MAX))
{
return HRESULT_FROM_WIN32(ERROR_FILE_TOO_LARGE);
}
pData += len + 1; pData += len + 1;
if (pfmSize < (len + 1))
{
return HRESULT_FROM_WIN32(ERROR_HANDLE_EOF);
}
pfmSize -= len + 1; pfmSize -= len + 1;
if (!pfmSize) if (!pfmSize)
return E_FAIL; return E_FAIL;
@ -488,6 +523,10 @@ HRESULT __cdecl LoadFromPortablePixMapHDR(
break; break;
pData += len + 1; pData += len + 1;
if (pfmSize < (len + 1))
{
return HRESULT_FROM_WIN32(ERROR_HANDLE_EOF);
}
pfmSize -= len + 1; pfmSize -= len + 1;
if (!pfmSize) if (!pfmSize)
return E_FAIL; return E_FAIL;
@ -502,6 +541,10 @@ HRESULT __cdecl LoadFromPortablePixMapHDR(
const bool bigendian = (aspectRatio >= 0); const bool bigendian = (aspectRatio >= 0);
pData += len + 1; pData += len + 1;
if (pfmSize < (len + 1))
{
return HRESULT_FROM_WIN32(ERROR_HANDLE_EOF);
}
pfmSize -= len + 1; pfmSize -= len + 1;
if (!pfmSize) if (!pfmSize)
return E_FAIL; return E_FAIL;
@ -636,6 +679,11 @@ HRESULT __cdecl SaveToPortablePixMapHDR(
return HRESULT_FROM_WIN32(ERROR_NOT_SUPPORTED); return HRESULT_FROM_WIN32(ERROR_NOT_SUPPORTED);
} }
if ((image.width > INT32_MAX) || (image.height > INT32_MAX))
{
return HRESULT_FROM_WIN32(ERROR_NOT_SUPPORTED);
}
char header[256] = {}; char header[256] = {};
const int len = sprintf_s(header, "P%c\n%zu %zu\n-1.000000\n", const int len = sprintf_s(header, "P%c\n%zu %zu\n-1.000000\n",
(image.format == DXGI_FORMAT_R32_FLOAT) ? 'f' : 'F', (image.format == DXGI_FORMAT_R32_FLOAT) ? 'f' : 'F',