Hi,
There seems to be a bug in InputFile::setFrameBuffer when a previous
call requests more channels than the current call.
InputFile::setFrameBuffer fails because the code is trying to
dereference an iterator over it's bounds.
-- in InputFile::setFrameBuffer --
const FrameBuffer &oldFrameBuffer = _data->tFileBuffer;
FrameBuffer::ConstIterator i = oldFrameBuffer.begin();
FrameBuffer::ConstIterator j = frameBuffer.begin();
while (i != oldFrameBuffer.end())
{
if (strcmp (i.name(), j.name()) || i.slice().type != j.slice().type)
// if frameBuffer size < oldFrameBuffer size then j will be invalid
break;
++i;
++j;
}
-- end code --
This code is in OpenEXR 1.4 and 1.6
I believe it should be changed to check the bounds of both i & j ( patch
attached ).
eg.
while (i != oldFrameBuffer.end() && j != frameBuffer.end())
Cheers,
Jon
p.s. I also lodged this as a bug on savannah but figured maybe that it
isn't looked at that often ( latest news date is a year ago ).
------------------------------------------------------------------------
--- ImfInputFile_old.cpp 2007-11-09 14:48:53.468125000 +0000
+++ ImfInputFile.cpp 2007-11-09 14:49:00.061875000 +0000
@@ -423,7 +423,7 @@
FrameBuffer::ConstIterator i = oldFrameBuffer.begin();
FrameBuffer::ConstIterator j = frameBuffer.begin();
- while (i != oldFrameBuffer.end())
+ while (i != oldFrameBuffer.end() && j != frameBuffer.end())
{
if (strcmp (i.name(), j.name()) || i.slice().type != j.slice().type)
break;
------------------------------------------------------------------------
_______________________________________________
Openexr-devel mailing list
address@hidden
http://lists.nongnu.org/mailman/listinfo/openexr-devel