Address #270: limit to INT_MAX tiles total

AcademySoftwareFoundation · Jul 10, 2019 · 7f438ff · 7f438ff
1 parent 1959f74
commit 7f438ff
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 7 deletions.
diff --git a/OpenEXR/IlmImf/ImfHeader.cpp b/OpenEXR/IlmImf/ImfHeader.cpp
@@ -73,7 +73,7 @@
 #include <sstream>
 #include <stdlib.h>
 #include <time.h>
-
+#include "ImfTiledMisc.h"
 #include "ImfNamespace.h"
 
 OPENEXR_IMF_INTERNAL_NAMESPACE_SOURCE_ENTER
@@ -915,6 +915,10 @@ Header::sanityCheck (bool isTiled, bool isMultipartFile) const
 				"width of " << maxTileHeight << "pixels.");
 	}
 
+    // computes size of chunk offset table. Throws an exception if this exceeds
+    // the maximum allowable size
+    getTiledChunkOffsetTableSize(*this);
+
 	if (tileDesc.mode != ONE_LEVEL &&
 	    tileDesc.mode != MIPMAP_LEVELS &&
 	    tileDesc.mode != RIPMAP_LEVELS)

diff --git a/OpenEXR/IlmImf/ImfTiledMisc.cpp b/OpenEXR/IlmImf/ImfTiledMisc.cpp
@@ -361,28 +361,42 @@ getTiledChunkOffsetTableSize(const Header& header)
     //
     // Calculate lineOffsetSize.
     //
-    int lineOffsetSize = 0;
+    Int64 lineOffsetSize = 0;
     const TileDescription &desc = header.tileDescription();
     switch (desc.mode)
     {
         case ONE_LEVEL:
         case MIPMAP_LEVELS:
             for (int i = 0; i < numXLevels; i++)
-                lineOffsetSize += numXTiles[i] * numYTiles[i];
-            break;
+            {
+                lineOffsetSize += Int64(numXTiles[i]) * Int64(numYTiles[i]);
+                if ( lineOffsetSize > INT_MAX )
+                {
+                    throw IEX_NAMESPACE::LogicExc("Maximum number of tiles exceeded");
+                }
+            }
+           break;
         case RIPMAP_LEVELS:
             for (int i = 0; i < numXLevels; i++)
+            {
                 for (int j = 0; j < numYLevels; j++)
-                    lineOffsetSize += numXTiles[i] * numYTiles[j];
-            break;
+                {
+                     lineOffsetSize += Int64(numXTiles[i]) * Int64(numYTiles[j]);
+                     if ( lineOffsetSize > INT_MAX )
+                     {
+                        throw IEX_NAMESPACE::LogicExc("Maximum number of tiles exceeded");
+                     }
+                }
+            }
+           break;
         case NUM_LEVELMODES :
             throw IEX_NAMESPACE::LogicExc("Bad level mode getting chunk offset table size");
     }
 
     delete[] numXTiles;
     delete[] numYTiles;
 
-    return lineOffsetSize;
+    return int(lineOffsetSize);
 }