From 9ea1b3323e6c8894dd3543fadbe1ec458e805011 Mon Sep 17 00:00:00 2001 From: Larry Gritz Date: Sat, 30 Dec 2023 17:07:26 -0800 Subject: [PATCH] fix(raw): Avoid buffer overrun for flip direction cases If you are looping i over range [0,width), and want index to go the other direction, you need `index = width - 1 - i`, not `index = width - i`. Identified by Sonar static analysis. Signed-off-by: Larry Gritz --- src/raw.imageio/rawinput.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/raw.imageio/rawinput.cpp b/src/raw.imageio/rawinput.cpp index f3ef946416..78586d9621 100644 --- a/src/raw.imageio/rawinput.cpp +++ b/src/raw.imageio/rawinput.cpp @@ -1505,7 +1505,7 @@ RawInput::read_native_scanline(int subimage, int miplevel, int y, int /*z*/, // to the array direction so we must copy the pixels into a temporary contiguous buffer else if (sizes.flip == 5 /*90 degrees CCW*/ || sizes.flip == 6 /*90 degrees CW*/) { - scanline_start = m_spec.height - y + sizes.left_margin; + scanline_start = m_spec.height - 1 - y + sizes.left_margin; if (sizes.flip == 6) { scanline_start = y + sizes.left_margin; } @@ -1514,7 +1514,7 @@ RawInput::read_native_scanline(int subimage, int miplevel, int y, int /*z*/, size_t index = (sizes.flip == 5) ? i - : m_spec.width + : m_spec.width - 1 - i; //flip the index if rotating 90 degrees CW buffer[index] = (m_processor->imgdata.rawdata.raw_image + offset)[sizes.raw_width * i + scanline_start];