[Openexr-devel] Bug in InputFile::setFrameBuffer?

[Jon Wadelton]

Hi,

There seems to be a bug in InputFile::setFrameBuffer when a previous call requests more channels than the current call.

InputFile::setFrameBuffer fails because the code is trying to dereference an iterator over it's bounds.

-- in InputFile::setFrameBuffer --

const FrameBuffer &oldFrameBuffer = _data->tFileBuffer;
FrameBuffer::ConstIterator i = oldFrameBuffer.begin();
FrameBuffer::ConstIterator j = frameBuffer.begin();
while (i != oldFrameBuffer.end())
{
  if (strcmp (i.name(), j.name()) || i.slice().type != j.slice().type) // if frameBuffer size < oldFrameBuffer size then j will be invalid
    break;
  ++i;
  ++j;
}

-- end code --
This code is in OpenEXR 1.4 and 1.6

I believe it should be changed to check the bounds of both i & j ( patch attached ).

eg.
while (i != oldFrameBuffer.end() && j != frameBuffer.end())

Cheers,
Jon

p.s. I also lodged this as a bug on savannah but figured maybe that it isn't looked at that often ( latest news date is a year ago ).

--- ImfInputFile_old.cpp        2007-11-09 14:48:53.468125000 +0000
+++ ImfInputFile.cpp    2007-11-09 14:49:00.061875000 +0000
@@ -423,7 +423,7 @@
        FrameBuffer::ConstIterator i = oldFrameBuffer.begin();
        FrameBuffer::ConstIterator j = frameBuffer.begin();
 
-       while (i != oldFrameBuffer.end())
+       while (i != oldFrameBuffer.end() && j != frameBuffer.end())
        {
            if (strcmp (i.name(), j.name()) || i.slice().type != j.slice().type)
                break;