tmaq
/
tornavis
1
0
Fork 0
Code Issues 2 Pull Requests 29 Packages Projects 24 Releases Wiki Activity

Render: correct buffer sizes for render cache paths 

FILE_CACHE_MAX was meant to be larger than FILE_MAX to make room
for additional layers in the path. An error in the define used
`FILE_MAXFILE + FILE_MAXFILE` instead of `FILE_MAXDIR + FILE_MAXFILE`
causing the value to be smaller allowing a buffer overflow when passing
the string into BLI_path_abs.

Correct the define and call on the directory component before
the file is added so it doesn't clamp the string length unnecessarily.

Note that some values weren't correct since the original commit [0],
although [1] moved them to a shared incorrect define.

[0]: 78cdc707ab
[1]: cef1b9c30f
This commit is contained in:
Campbell Barton 2024-03-28 11:59:40 +11:00
parent db466e9578
commit 2a892012be
1 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
source/blender/render/intern/render_result.cc
View File

@ -982,13 +982,15 @@ bool render_result_exr_file_read_path(RenderResult *rr,
return true;
}
#define FILE_CACHE_MAX (FILE_MAXFILE + FILE_MAXFILE + MAX_ID_NAME + 100)
#define FILE_CACHE_MAX (FILE_MAXDIR + FILE_MAXFILE + MAX_ID_NAME + 100)
static void render_result_exr_file_cache_path(Scene *sce,
const char *root,
char r_path[FILE_CACHE_MAX])
{
char filename_full[FILE_MAX + MAX_ID_NAME + 100], filename[FILE_MAXFILE], dirname[FILE_MAXDIR];
char filename_full[FILE_MAXFILE + MAX_ID_NAME + 100];
char filename[FILE_MAXFILE];
char dirname[FILE_MAXDIR];
char path_digest[16] = {0};
char path_hexdigest[33];
@ -1006,19 +1008,19 @@ static void render_result_exr_file_cache_path(Scene *sce,
BLI_hash_md5_to_hexdigest(path_digest, path_hexdigest);
/* Default to *non-volatile* temp dir. */
char root_buf[FILE_MAX];
if (*root == '\0') {
root = BKE_tempdir_base();
}
else if (BLI_path_is_rel(root)) {
STRNCPY(root_buf, root);
BLI_path_abs(root_buf, dirname);
root = root_buf;
}
SNPRINTF(filename_full, "cached_RR_%s_%s_%s.exr", filename, sce->id.name + 2, path_hexdigest);
BLI_path_join(r_path, FILE_CACHE_MAX, root, filename_full);
if (BLI_path_is_rel(r_path)) {
char path_temp[FILE_MAX];
STRNCPY(path_temp, r_path);
BLI_path_abs(path_temp, dirname);
BLI_strncpy(r_path, path_temp, FILE_CACHE_MAX);
}
}
void render_result_exr_file_cache_write(Render *re)