Skip to content

Commit 7006775

Browse files
committed
Add guard to ensure imageData is not accessed if invalid - addresses AcademySoftwareFoundation#2304
1 parent dcd0285 commit 7006775

File tree

1 file changed

+31
-31
lines changed

1 file changed

+31
-31
lines changed

source/MaterialXRenderMsl/MetalTextureHandler.mm

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -202,54 +202,54 @@
202202
std::vector<unsigned char> rearrangedDataC;
203203
void* imageData = image->getResourceBuffer();
204204

205-
if ((pixelFormat == MTLPixelFormatRGBA32Float || pixelFormat == MTLPixelFormatRGBA8Unorm) && channelCount == 3)
205+
id<MTLBuffer> buffer = nil;
206+
if (imageData)
206207
{
207-
bool isFloat = pixelFormat == MTLPixelFormatRGBA32Float;
208+
if ((pixelFormat == MTLPixelFormatRGBA32Float || pixelFormat == MTLPixelFormatRGBA8Unorm) && channelCount == 3)
209+
{
210+
bool isFloat = pixelFormat == MTLPixelFormatRGBA32Float;
208211

209-
sourceBytesPerRow = sourceBytesPerRow / 3 * 4;
210-
sourceBytesPerImage = sourceBytesPerImage / 3 * 4;
212+
sourceBytesPerRow = sourceBytesPerRow / 3 * 4;
213+
sourceBytesPerImage = sourceBytesPerImage / 3 * 4;
211214

212-
size_t srcIdx = 0;
215+
size_t srcIdx = 0;
213216

214-
if (isFloat)
215-
{
216-
rearrangedDataF.resize(sourceBytesPerImage / sizeof(float));
217-
for (size_t dstIdx = 0; dstIdx < rearrangedDataF.size(); ++dstIdx)
217+
if (isFloat)
218218
{
219-
if ((dstIdx & 0x3) == 3)
219+
rearrangedDataF.resize(sourceBytesPerImage / sizeof(float));
220+
for (size_t dstIdx = 0; dstIdx < rearrangedDataF.size(); ++dstIdx)
220221
{
221-
rearrangedDataF[dstIdx] = 1.0f;
222-
continue;
222+
if ((dstIdx & 0x3) == 3)
223+
{
224+
rearrangedDataF[dstIdx] = 1.0f;
225+
continue;
226+
}
227+
228+
rearrangedDataF[dstIdx] = ((float*) imageData)[srcIdx++];
223229
}
224230

225-
rearrangedDataF[dstIdx] = ((float*) imageData)[srcIdx++];
231+
imageData = rearrangedDataF.data();
226232
}
227-
228-
imageData = rearrangedDataF.data();
229-
}
230-
else
231-
{
232-
rearrangedDataC.resize(sourceBytesPerImage);
233-
for (size_t dstIdx = 0; dstIdx < rearrangedDataC.size(); ++dstIdx)
233+
else
234234
{
235-
if ((dstIdx & 0x3) == 3)
235+
rearrangedDataC.resize(sourceBytesPerImage);
236+
for (size_t dstIdx = 0; dstIdx < rearrangedDataC.size(); ++dstIdx)
236237
{
237-
rearrangedDataC[dstIdx] = 255;
238-
continue;
238+
if ((dstIdx & 0x3) == 3)
239+
{
240+
rearrangedDataC[dstIdx] = 255;
241+
continue;
242+
}
243+
244+
rearrangedDataC[dstIdx] = ((unsigned char*) imageData)[srcIdx++];
239245
}
240246

241-
rearrangedDataC[dstIdx] = ((unsigned char*) imageData)[srcIdx++];
247+
imageData = rearrangedDataC.data();
242248
}
243249

244-
imageData = rearrangedDataC.data();
250+
channelCount = 4;
245251
}
246252

247-
channelCount = 4;
248-
}
249-
250-
id<MTLBuffer> buffer = nil;
251-
if (imageData)
252-
{
253253
buffer = [_device newBufferWithBytes:imageData
254254
length:sourceBytesPerImage
255255
options:MTLStorageModeShared];

0 commit comments

Comments
 (0)