Fix(rla): Invalid read from an empty vector during RLA load (#3960)

The incoming length of the RLE data could be 0. In this case we would attempt to take the address of the 1st element of an empty vector. Added a new 1004-byte file to the local test suite. Fixes #3951 --------- Signed-off-by: Jesse Yurkovich <[email protected]>
AcademySoftwareFoundation · Aug 24, 2023 · afe8159 · afe8159
1 parent cdc8218
commit afe8159
Show file tree

Hide file tree

Showing 4 changed files with 5 additions and 1 deletion.
diff --git a/src/rla.imageio/rlainput.cpp b/src/rla.imageio/rlainput.cpp
@@ -548,7 +548,7 @@ RLAInput::decode_channel_group(int first_channel, short num_channels,
         size_t length = lenu16;
         // Read the encoded RLE record
         encoded.resize(length);
-        if (!read(&encoded[0], length)) {
+        if (!length || !read(&encoded[0], length)) {
             errorfmt("Read error: couldn't read RLE data span");
             return false;
         }

diff --git a/testsuite/rla/ref/out.txt b/testsuite/rla/ref/out.txt
@@ -316,5 +316,8 @@ Full command line was:
 oiiotool ERROR: read : "src/crash-1629.rla": Read error: malformed RLE record
 Full command line was:
 > oiiotool src/crash-1629.rla -o crash3.exr
+oiiotool ERROR: read : "src/crash-3951.rla": Read error: couldn't read RLE data span
+Full command line was:
+> oiiotool src/crash-3951.rla -o crash4.exr
 Comparing "rlacrop.rla" and "ref/rlacrop.rla"
 PASS
diff --git a/testsuite/rla/run.py b/testsuite/rla/run.py
@@ -21,5 +21,6 @@
 command += oiiotool(OIIO_TESTSUITE_IMAGEDIR + "/rla/crash1.rla -o crash1.exr", failureok = True)
 command += oiiotool(OIIO_TESTSUITE_IMAGEDIR + "/rla/crash2.rla -o crash2.exr", failureok = True)
 command += oiiotool("src/crash-1629.rla -o crash3.exr", failureok = True)
+command += oiiotool("src/crash-3951.rla -o crash4.exr", failureok = True)
 
 outputs = [ "rlacrop.rla", 'out.txt' ]
diff --git a/testsuite/rla/src/crash-3951.rla b/testsuite/rla/src/crash-3951.rla