mirror/opencv
1
0
Fork 0
mirror of https://github.com/opencv/opencv.git synced 2025-01-18 06:03:15 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix rollover when computing buffer size in tiff decoder (bug #2161)

Browse Source
This commit is contained in:
Andrey Kamaev 2013-01-29 20:29:31 +04:00
parent b4d0dff4c5
commit 62ce815197
1 changed files with 15 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
modules/highgui/src/grfmt_tiff.cpp
View File

@ -168,7 +168,6 @@ bool TiffDecoder::readData( Mat& img )
bool result = false;
bool color = img.channels() > 1;
uchar* data = img.data;
int step = (int)img.step;
if( img.depth() != CV_8U && img.depth() != CV_16U && img.depth() != CV_32F && img.depth() != CV_64F )
return false;
@ -211,14 +210,14 @@ bool TiffDecoder::readData( Mat& img )
if( tile_height0 <= 0 )
tile_height0 = m_height;
AutoBuffer<uchar> _buffer(tile_height0*tile_width0*8);
AutoBuffer<uchar> _buffer( size_t(8) * tile_height0*tile_width0);
uchar* buffer = _buffer;
ushort* buffer16 = (ushort*)buffer;
float* buffer32 = (float*)buffer;
double* buffer64 = (double*)buffer;
int tileidx = 0;
for( y = 0; y < m_height; y += tile_height0, data += step*tile_height0 )
for( y = 0; y < m_height; y += tile_height0, data += img.step*tile_height0 )
{
int tile_height = tile_height0;
@ -250,11 +249,11 @@ bool TiffDecoder::readData( Mat& img )
for( i = 0; i < tile_height; i++ )
if( color )
icvCvt_BGRA2BGR_8u_C4C3R( buffer + i*tile_width*4, 0,
data + x*3 + step*(tile_height - i - 1), 0,
data + x*3 + img.step*(tile_height - i - 1), 0,
cvSize(tile_width,1), 2 );
else
icvCvt_BGRA2Gray_8u_C4C1R( buffer + i*tile_width*4, 0,
data + x + step*(tile_height - i - 1), 0,
data + x + img.step*(tile_height - i - 1), 0,
cvSize(tile_width,1), 2 );
break;
}
@ -279,19 +278,19 @@ bool TiffDecoder::readData( Mat& img )
if( ncn == 1 )
{
icvCvt_Gray2BGR_16u_C1C3R(buffer16 + i*tile_width*ncn, 0,
(ushort*)(data + step*i) + x*3, 0,
(ushort*)(data + img.step*i) + x*3, 0,
cvSize(tile_width,1) );
}
else if( ncn == 3 )
{
icvCvt_RGB2BGR_16u_C3R(buffer16 + i*tile_width*ncn, 0,
(ushort*)(data + step*i) + x*3, 0,
(ushort*)(data + img.step*i) + x*3, 0,
cvSize(tile_width,1) );
}
else
{
icvCvt_BGRA2BGR_16u_C4C3R(buffer16 + i*tile_width*ncn, 0,
(ushort*)(data + step*i) + x*3, 0,
(ushort*)(data + img.step*i) + x*3, 0,
cvSize(tile_width,1), 2 );
}
}
@ -299,14 +298,14 @@ bool TiffDecoder::readData( Mat& img )
{
if( ncn == 1 )
{
memcpy((ushort*)(data + step*i)+x,
memcpy((ushort*)(data + img.step*i)+x,
buffer16 + i*tile_width*ncn,
tile_width*sizeof(buffer16[0]));
}
else
{
icvCvt_BGRA2Gray_16u_CnC1R(buffer16 + i*tile_width*ncn, 0,
(ushort*)(data + step*i) + x, 0,
(ushort*)(data + img.step*i) + x, 0,
cvSize(tile_width,1), ncn, 2 );
}
}
@ -332,13 +331,13 @@ bool TiffDecoder::readData( Mat& img )
{
if(dst_bpp == 32)
{
memcpy((float*)(data + step*i)+x,
memcpy((float*)(data + img.step*i)+x,
buffer32 + i*tile_width*ncn,
tile_width*sizeof(buffer32[0]));
}
else
{
memcpy((double*)(data + step*i)+x,
memcpy((double*)(data + img.step*i)+x,
buffer64 + i*tile_width*ncn,
tile_width*sizeof(buffer64[0]));
}
@ -485,7 +484,7 @@ bool TiffEncoder::writeLibTiff( const Mat& img, const vector<int>& params)
// row buffer, because TIFFWriteScanline modifies the original data!
size_t scanlineSize = TIFFScanlineSize(pTiffHandle);
AutoBuffer<uchar,1024> _buffer(scanlineSize+32);
AutoBuffer<uchar> _buffer(scanlineSize+32);
uchar* buffer = _buffer;
if (!buffer)
{
@ -593,9 +592,9 @@ bool TiffEncoder::write( const Mat& img, const vector<int>& /*params*/)
#endif*/
int directoryOffset = 0;
AutoBuffer<int,1024> stripOffsets(stripCount);
AutoBuffer<short,1024> stripCounts(stripCount);
AutoBuffer<uchar,1024> _buffer(fileStep+32);
AutoBuffer<int> stripOffsets(stripCount);
AutoBuffer<short> stripCounts(stripCount);
AutoBuffer<uchar> _buffer(fileStep+32);
uchar* buffer = _buffer;
int stripOffsetsOffset = 0;
int stripCountsOffset = 0;