[Bf-blender-cvs] [bf5e717ef56] master: Fix T51609: Bake Texture, Margin crashing Blender

[Sergey Sharybin]

Commit: bf5e717ef5617c597710c2836b511f9f089fcfc2
Author: Sergey Sharybin
Date:   Fri May 26 11:27:27 2017 +0200
Branches: master
https://developer.blender.org/rBbf5e717ef5617c597710c2836b511f9f089fcfc2

Fix T51609: Bake Texture, Margin crashing Blender

Integer overflow in margin filter code.

===================================================================

M	source/blender/imbuf/intern/filter.c

===================================================================

diff --git a/source/blender/imbuf/intern/filter.c b/source/blender/imbuf/intern/filter.c
index 1987c6d2a9a..38609d0a342 100644
--- a/source/blender/imbuf/intern/filter.c
+++ b/source/blender/imbuf/intern/filter.c
@@ -406,7 +406,7 @@ void IMB_filter_extend(struct ImBuf *ibuf, char *mask, int filter)
 	const int height = ibuf->y;
 	const int depth = 4;     /* always 4 channels */
 	const int chsize = ibuf->rect_float ? sizeof(float) : sizeof(unsigned char);
-	const int bsize = width * height * depth * chsize;
+	const size_t bsize = ((size_t)width) * height * depth * chsize;
 	const bool is_float = (ibuf->rect_float != NULL);
 	void *dstbuf = (void *) MEM_dupallocN(ibuf->rect_float ? (void *) ibuf->rect_float : (void *) ibuf->rect);
 	char *dstmask = mask == NULL ? NULL : (char *) MEM_dupallocN(mask);
@@ -499,7 +499,9 @@ void IMB_filter_extend(struct ImBuf *ibuf, char *mask, int filter)
 
 		/* keep the original buffer up to date. */
 		memcpy(srcbuf, dstbuf, bsize);
-		if (dstmask != NULL) memcpy(srcmask, dstmask, width * height);
+		if (dstmask != NULL) {
+			memcpy(srcmask, dstmask, ((size_t)width) * height);
+		}
 	}
 
 	/* free memory */