fix unitialised pointer and double-delete bugs (#661)

Signed-off-by: Peter Hillman <[email protected]>
AcademySoftwareFoundation · Feb 23, 2020 · 817faac · 817faac
1 parent a0e84f6
commit 817faac
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 2 deletions.
diff --git a/OpenEXR/IlmImf/ImfDeepTiledInputFile.cpp b/OpenEXR/IlmImf/ImfDeepTiledInputFile.cpp
@@ -601,6 +601,15 @@ TileBufferTask::execute ()
             _tileBuffer->uncompressedData = _tileBuffer->buffer;
         }
 
+	//
+	// sanity check data size: the uncompressed data should be exactly 
+	// 'sizeOfTile' (if it's less, the file is corrupt and there'll be a buffer overrun)
+	//
+        if(_tileBuffer->dataSize != sizeOfTile)
+	{
+		THROW (IEX_NAMESPACE::InputExc, "size mismatch when reading deep tile: expected " << sizeOfTile << "bytes of uncompressed data but got " << _tileBuffer->dataSize);
+	}
+
         //
         // Convert the tile of pixel data back from the machine-independent
         // representation, and store the result in the frame buffer.

diff --git a/OpenEXR/IlmImf/ImfTiledInputFile.cpp b/OpenEXR/IlmImf/ImfTiledInputFile.cpp
@@ -265,6 +265,7 @@ TiledInputFile::Data::Data (int numThreads):
     partNumber (-1),
     multiPartBackwardSupport(false),
     numThreads(numThreads),
+    multiPartFile(nullptr),
     memoryMapped(false),
     _streamData(NULL),
     _deleteStream(false)
@@ -754,7 +755,7 @@ TiledInputFile::TiledInputFile (const char fileName[], int numThreads):
                 }
             }
         }
-        if ( _data->_streamData != 0)
+        if ( _data->_streamData != 0 && !isMultiPart(_data->version))
         {
             delete _data->_streamData->is;
             _data->_streamData->is = is = 0;
@@ -879,7 +880,20 @@ TiledInputFile::TiledInputFile (InputPartData* part)
     }
     catch(...)
     {
-        if (_data) delete _data;
+        if(_data)
+        {
+          if (!_data->memoryMapped)
+          {
+            for (size_t i = 0; i < _data->tileBuffers.size(); i++)
+            {
+                if(_data->tileBuffers[i])
+                {
+                   delete [] _data->tileBuffers[i]->buffer;
+                }
+            }
+          }
+          delete _data;
+        }
         throw;
     }
 }