OpenEXR/CVE-2021-20302.patch
hundred-ci 7aac8ec197 fix CVE-2021-20300 CVE-2021-20302 CVE-2021-3933
(cherry picked from commit 039a67120ac7283a3a2592a2a78a044b2105334c)
2022-07-18 09:51:14 +08:00

34 lines
1.8 KiB
Diff

diff -Naru "openexr-2.2.0 copy/IlmImf/ImfDeepScanLineInputFile.cpp" openexr-2.2.0/IlmImf/ImfDeepScanLineInputFile.cpp
--- "openexr-2.2.0 copy/IlmImf/ImfDeepScanLineInputFile.cpp" 2022-07-06 16:43:15.752732000 +0800
+++ openexr-2.2.0/IlmImf/ImfDeepScanLineInputFile.cpp 2022-07-06 16:45:09.368817000 +0800
@@ -717,10 +717,12 @@
int width = (_ifd->maxX - _ifd->minX + 1);
+ ptrdiff_t base = reinterpret_cast<ptrdiff_t>(&_ifd->sampleCount[0][0]);
+ base -= sizeof(unsigned int)*_ifd->minX;
+ base -= sizeof(unsigned int)*static_cast<ptrdiff_t>(_ifd->minY) * static_cast<ptrdiff_t>(width);
+
copyIntoDeepFrameBuffer (readPtr, slice.base,
- (char*) (&_ifd->sampleCount[0][0]
- - _ifd->minX
- - _ifd->minY * width),
+ reinterpret_cast<char*>(base),
sizeof(unsigned int) * 1,
sizeof(unsigned int) * width,
y, _ifd->minX, _ifd->maxX,
diff -Naru "openexr-2.2.0 copy/IlmImf/ImfTiledInputFile.cpp" openexr-2.2.0/IlmImf/ImfTiledInputFile.cpp
--- "openexr-2.2.0 copy/IlmImf/ImfTiledInputFile.cpp" 2022-07-06 16:43:15.892732000 +0800
+++ openexr-2.2.0/IlmImf/ImfTiledInputFile.cpp 2022-07-06 16:50:27.438890000 +0800
@@ -903,6 +903,9 @@
if (!isTiled (_data->version))
throw IEX_NAMESPACE::ArgExc ("Expected a tiled file but the file is not tiled.");
+ if (isNonImage (_data->version))
+ throw IEX_NAMESPACE::ArgExc ("File is not a regular tiled image.");
+
}
else
{