Fix(rla): Invalid read from an empty vector during RLA load (AcademyS…

…oftwareFoundation#3960) The incoming length of the RLE data could be 0. In this case we would attempt to take the address of the 1st element of an empty vector. Added a new 1004-byte file to the local test suite. Fixes AcademySoftwareFoundation#3951 --------- Signed-off-by: Jesse Yurkovich <[email protected]>
lgritz · Aug 25, 2023 · 1f05697 · 1f05697
1 parent 2031172
commit 1f05697
Show file tree

Hide file tree

Showing 4 changed files with 6 additions and 2 deletions.
diff --git a/src/rla.imageio/rlainput.cpp b/src/rla.imageio/rlainput.cpp
@@ -550,8 +550,8 @@ RLAInput::decode_channel_group(int first_channel, short num_channels,
         size_t length = lenu16;
         // Read the encoded RLE record
         encoded.resize(length);
-        if (!read(&encoded[0], length)) {
-            errorf("Read error: couldn't read RLE data span");
+        if (!length || !read(&encoded[0], length)) {
+            errorfmt("Read error: couldn't read RLE data span");
             return false;
         }
 

diff --git a/testsuite/rla/ref/out.txt b/testsuite/rla/ref/out.txt
@@ -316,5 +316,8 @@ Full command line was:
 oiiotool ERROR: read : "src/crash-1629.rla": Read error: malformed RLE record
 Full command line was:
 > oiiotool src/crash-1629.rla -o crash3.exr
+oiiotool ERROR: read : "src/crash-3951.rla": Read error: couldn't read RLE data span
+Full command line was:
+> oiiotool src/crash-3951.rla -o crash4.exr
 Comparing "rlacrop.rla" and "ref/rlacrop.rla"
 PASS
diff --git a/testsuite/rla/run.py b/testsuite/rla/run.py
@@ -21,5 +21,6 @@
 command += oiiotool(OIIO_TESTSUITE_IMAGEDIR + "/rla/crash1.rla -o crash1.exr", failureok = True)
 command += oiiotool(OIIO_TESTSUITE_IMAGEDIR + "/rla/crash2.rla -o crash2.exr", failureok = True)
 command += oiiotool("src/crash-1629.rla -o crash3.exr", failureok = True)
+command += oiiotool("src/crash-3951.rla -o crash4.exr", failureok = True)
 
 outputs = [ "rlacrop.rla", 'out.txt' ]
diff --git a/testsuite/rla/src/crash-3951.rla b/testsuite/rla/src/crash-3951.rla