Skip to content

fix(dpx): ignore end-of-line padding when writing - #5472

Open
lgritz wants to merge 1 commit into
AcademySoftwareFoundation:mainfrom
lgritz:lg-dpxwrite
Open

lgritz wants to merge 1 commit into
AcademySoftwareFoundation:mainfrom
lgritz:lg-dpxwrite

Conversation

@lgritz

@lgritz lgritz commented Sep 14, 2026

Copy link
Copy Markdown
Collaborator

The libdpx writer strides the caller's pixel buffer by the declared end-of-line padding, but our scanline buffer is always tightly packed. Since the value was passed through from an input file's header, a crafted DPX made the writer read far past the end of the buffer during dpx-to-dpx conversion. Declare zero padding instead.

Fixes #1861

Assisted-by: Claude Code / Claude Opus 5

The libdpx writer strides the caller's pixel buffer by the declared
end-of-line padding, but our scanline buffer is always tightly packed.
Since the value was passed through from an input file's header, a
crafted DPX made the writer read far past the end of the buffer during
dpx-to-dpx conversion. Declare zero padding instead; we can never supply
a padded buffer, so the pass-through could not have produced a correct
file anyway.

Fixes 1861

Assisted-by: Claude Code / Claude Opus 5

Signed-off-by: Larry Gritz <lg@larrygritz.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

heap-buffer-overflow in dpx::WriteBuffer

1 participant