diff options
| author | Rider Linden <rider@lindenlab.com> | 2017-09-22 09:18:34 -0700 |
|---|---|---|
| committer | Rider Linden <rider@lindenlab.com> | 2017-09-22 09:18:34 -0700 |
| commit | 5d3599f5d155dc112c8f05197c8fc73397084e71 (patch) | |
| tree | 1b67cdb5944a222c1de6de3b974caea78a019762 /indra/llimage | |
| parent | 150fba7c5cd24ad9ab343e762bfd15032e6a9462 (diff) | |
| parent | 38d9454cbf30f470a723d912be2080f63ae3fa47 (diff) | |
Merge
Diffstat (limited to 'indra/llimage')
| -rw-r--r-- | indra/llimage/llimagepng.cpp | 4 | ||||
| -rw-r--r-- | indra/llimage/llpngwrapper.cpp | 8 | ||||
| -rw-r--r-- | indra/llimage/llpngwrapper.h | 2 |
3 files changed, 10 insertions, 4 deletions
diff --git a/indra/llimage/llimagepng.cpp b/indra/llimage/llimagepng.cpp index a299602d79..a4823ed859 100644 --- a/indra/llimage/llimagepng.cpp +++ b/indra/llimage/llimagepng.cpp @@ -124,12 +124,12 @@ bool LLImagePNG::encode(const LLImageRaw* raw_image, F32 encode_time) // Temporary buffer to hold the encoded image. Note: the final image // size should be much smaller due to compression. - U32 bufferSize = getWidth() * getHeight() * getComponents() + 1024; + U32 bufferSize = getWidth() * getHeight() * getComponents() + 8192; U8* tmpWriteBuffer = new U8[ bufferSize ]; // Delegate actual encoding work to wrapper LLPngWrapper pngWrapper; - if (! pngWrapper.writePng(raw_image, tmpWriteBuffer)) + if (!pngWrapper.writePng(raw_image, tmpWriteBuffer, bufferSize)) { setLastError(pngWrapper.getErrorMessage()); delete[] tmpWriteBuffer; diff --git a/indra/llimage/llpngwrapper.cpp b/indra/llimage/llpngwrapper.cpp index da289ea889..eb70b78a36 100644 --- a/indra/llimage/llpngwrapper.cpp +++ b/indra/llimage/llpngwrapper.cpp @@ -112,6 +112,11 @@ void LLPngWrapper::readDataCallback(png_structp png_ptr, png_bytep dest, png_siz void LLPngWrapper::writeDataCallback(png_structp png_ptr, png_bytep src, png_size_t length) { PngDataInfo *dataInfo = (PngDataInfo *) png_get_io_ptr(png_ptr); + if (dataInfo->mOffset + length > dataInfo->mDataSize) + { + png_error(png_ptr, "Data write error. Requested data size exceeds available data size."); + return; + } U8 *dest = &dataInfo->mData[dataInfo->mOffset]; memcpy(dest, src, length); dataInfo->mOffset += static_cast<U32>(length); @@ -272,7 +277,7 @@ void LLPngWrapper::updateMetaData() // Method to write raw image into PNG at dest. The raw scanline begins // at the bottom of the image per SecondLife conventions. -BOOL LLPngWrapper::writePng(const LLImageRaw* rawImage, U8* dest) +BOOL LLPngWrapper::writePng(const LLImageRaw* rawImage, U8* dest, size_t destSize) { try { @@ -313,6 +318,7 @@ BOOL LLPngWrapper::writePng(const LLImageRaw* rawImage, U8* dest) PngDataInfo dataPtr; dataPtr.mData = dest; dataPtr.mOffset = 0; + dataPtr.mDataSize = destSize; png_set_write_fn(mWritePngPtr, &dataPtr, &writeDataCallback, &writeFlush); // Setup image params diff --git a/indra/llimage/llpngwrapper.h b/indra/llimage/llpngwrapper.h index 27d7df3bef..8d42317b0f 100644 --- a/indra/llimage/llpngwrapper.h +++ b/indra/llimage/llpngwrapper.h @@ -45,7 +45,7 @@ public: BOOL isValidPng(U8* src); BOOL readPng(U8* src, S32 dataSize, LLImageRaw* rawImage, ImageInfo *infop = NULL); - BOOL writePng(const LLImageRaw* rawImage, U8* dst); + BOOL writePng(const LLImageRaw* rawImage, U8* dst, size_t destSize); U32 getFinalSize(); const std::string& getErrorMessage(); |