[Bf-blender-cvs] SVN commit: /data/svn/bf-blender [59978] trunk/blender/source/blender/imbuf /intern/allocimbuf.c: fix [#36187] Crash loading large images

[Campbell Barton]

Revision: 59978
          http://projects.blender.org/scm/viewvc.php?view=rev&root=bf-blender&revision=59978
Author:   campbellbarton
Date:     2013-09-10 00:53:39 +0000 (Tue, 10 Sep 2013)
Log Message:
-----------
fix [#36187] Crash loading large images

alloc size was larger then an int, use size_t for all image alloc sizes.

Modified Paths:
--------------
    trunk/blender/source/blender/imbuf/intern/allocimbuf.c

Modified: trunk/blender/source/blender/imbuf/intern/allocimbuf.c
===================================================================
--- trunk/blender/source/blender/imbuf/intern/allocimbuf.c	2013-09-10 00:36:14 UTC (rev 59977)
+++ trunk/blender/source/blender/imbuf/intern/allocimbuf.c	2013-09-10 00:53:39 UTC (rev 59978)
@@ -193,14 +193,15 @@
 
 short addzbufImBuf(ImBuf *ibuf)
 {
-	int size;
+	size_t size;
 	
 	if (ibuf == NULL) return FALSE;
 	
 	IMB_freezbufImBuf(ibuf);
 	
-	size = ibuf->x * ibuf->y * sizeof(unsigned int);
-	if ((ibuf->zbuf = MEM_mapallocN(size, "addzbufImBuf"))) {
+	size = (size_t)(ibuf->x * ibuf->y) * sizeof(unsigned int);
+
+	if ((ibuf->zbuf = MEM_mapallocN(size, __func__))) {
 		ibuf->mall |= IB_zbuf;
 		ibuf->flags |= IB_zbuf;
 		return TRUE;
@@ -211,14 +212,15 @@
 
 short addzbuffloatImBuf(ImBuf *ibuf)
 {
-	int size;
+	size_t size;
 	
 	if (ibuf == NULL) return FALSE;
 	
 	IMB_freezbuffloatImBuf(ibuf);
 	
-	size = ibuf->x * ibuf->y * sizeof(float);
-	if ((ibuf->zbuf_float = MEM_mapallocN(size, "addzbuffloatImBuf"))) {
+	size = (size_t)(ibuf->x * ibuf->y) * sizeof(float);
+
+	if ((ibuf->zbuf_float = MEM_mapallocN(size, __func__))) {
 		ibuf->mall |= IB_zbuffloat;
 		ibuf->flags |= IB_zbuffloat;
 		return TRUE;
@@ -289,18 +291,17 @@
 
 short imb_addrectfloatImBuf(ImBuf *ibuf)
 {
-	int size;
+	size_t size;
 	
 	if (ibuf == NULL) return FALSE;
 	
 	if (ibuf->rect_float)
 		imb_freerectfloatImBuf(ibuf);  /* frees mipmap too, hrm */
 	
-	size = ibuf->x * ibuf->y;
-	size = size * 4 * sizeof(float);
+	size = (size_t)(ibuf->x * ibuf->y) * sizeof(float[4]);
+
 	ibuf->channels = 4;
-	
-	if ((ibuf->rect_float = MEM_mapallocN(size, "imb_addrectfloatImBuf"))) {
+	if ((ibuf->rect_float = MEM_mapallocN(size, __func__))) {
 		ibuf->mall |= IB_rectfloat;
 		ibuf->flags |= IB_rectfloat;
 		return TRUE;
@@ -312,7 +313,7 @@
 /* question; why also add zbuf? */
 short imb_addrectImBuf(ImBuf *ibuf)
 {
-	int size;
+	size_t size;
 
 	if (ibuf == NULL) return FALSE;
 	
@@ -321,10 +322,9 @@
 		MEM_freeN(ibuf->rect);
 	ibuf->rect = NULL;
 	
-	size = ibuf->x * ibuf->y;
-	size = size * sizeof(unsigned int);
+	size = (size_t)(ibuf->x * ibuf->y) * sizeof(unsigned int);
 
-	if ((ibuf->rect = MEM_mapallocN(size, "imb_addrectImBuf"))) {
+	if ((ibuf->rect = MEM_mapallocN(size, __func__))) {
 		ibuf->mall |= IB_rect;
 		ibuf->flags |= IB_rect;
 		if (ibuf->planes > 32) return (addzbufImBuf(ibuf));