fix(softimage): validate channel packet maps

Signed-off-by: Vlad (Kuzmin) Erium <libalias@gmail.com>

Author: ssh4net

src/softimage.imageio/softimageinput.cpp

@@ -110,7 +110,9 @@ SoftimageInput::open(const std::string& name, ImageSpec& spec)
 
     // Get the ChannelPackets
     ChannelPacket curPacket;
-    int nchannels = 0;
+    int nchannels        = 0;
+    int bits_per_channel = 0;
+    bool seen_channel[4] = { false, false, false, false };
     std::vector<std::string> encodings;
     do {
         // Read the next packet into curPacket and store it off
@@ -126,13 +128,61 @@ SoftimageInput::open(const std::string& name, ImageSpec& spec)
             close();
             return false;
         }
+
+        if (bits_per_channel == 0) {
+            bits_per_channel = curPacket.size;
+        } else if (curPacket.size != bits_per_channel) {
+            errorfmt("Inconsistent bits per channel {}", curPacket.size);
+            close();
+            return false;
+        }
+
+        if ((curPacket.type & 0x3) > MIXED_RUN_LENGTH) {
+            errorfmt("Unsupported channel encoding {}",
+                     static_cast<int>(curPacket.type));
+            close();
+            return false;
+        }
+
+        if (curPacket.channelCode
+            & ~(RED_CHANNEL | GREEN_CHANNEL | BLUE_CHANNEL | ALPHA_CHANNEL)) {
+            errorfmt("Unsupported channel code 0x{:x}",
+                     static_cast<int>(curPacket.channelCode));
+            close();
+            return false;
+        }
+
+        std::vector<int> channels = curPacket.channels();
+        if (channels.empty()) {
+            errorfmt("Channel packet has no channels");
+            close();
+            return false;
+        }
+
+        for (int channel : channels) {
+            if (seen_channel[channel]) {
+                errorfmt("Duplicate channel {} in channel packets", channel);
+                close();
+                return false;
+            }
+            seen_channel[channel] = true;
+        }
+
         m_channel_packets.push_back(curPacket);
 
         // Add the number of channels in this packet to nchannels
-        nchannels += curPacket.channels().size();
+        nchannels += static_cast<int>(channels.size());
         encodings.push_back(encoding_name(m_channel_packets.back().type));
     } while (curPacket.chained);
 
+    for (int channel = 0; channel < nchannels; ++channel) {
+        if (!seen_channel[channel]) {
+            errorfmt("Sparse channel packets are not supported");
+            close();
+            return false;
+        }
+    }
+
     // Get the depth per pixel per channel
     TypeDesc chanType = TypeDesc::UINT8;
     if (curPacket.size == 16)

testsuite/softimage/ref/out.txt

@@ -44,3 +44,6 @@ src/broken01.pic :   16 x    4, 1 channel, uint8 softimage
     Stats FiniteCount: 64 
     Constant: No
     Monochrome: Yes
+sparse-alpha-uncompressed-rejected
+sparse-alpha-pure-rle-rejected
+sparse-alpha-mixed-rle-rejected

testsuite/softimage/run.py

@@ -13,3 +13,15 @@
 # Regression testing of error handling and corrupt files
 command += info_command ("--stats src/broken01.pic",
                          info_program="iinfo", failureok=True)
+
+command += run_app (pythonbin + " src/make-sparse-channel-pics.py",
+                    silent=True)
+sparse_channel_files = [
+    "sparse-alpha-uncompressed.pic",
+    "sparse-alpha-pure-rle.pic",
+    "sparse-alpha-mixed-rle.pic",
+]
+for f in sparse_channel_files:
+    command += run_app ("(" + oiio_app("iconvert") + f
+                        + " out.null > /dev/null 2>&1 "
+                        + "|| echo " + f.replace(".pic", "-rejected") + ")")

testsuite/softimage/src/make-sparse-channel-pics.py

@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+
+# Copyright Contributors to the OpenImageIO project.
+# SPDX-License-Identifier: Apache-2.0
+# https://github.com/AcademySoftwareFoundation/OpenImageIO
+
+import struct
+
+
+MAGIC = 0x5380F634
+WIDTH = 1
+HEIGHT = 1
+ALPHA_CHANNEL = 0x10
+
+UNCOMPRESSED = 0
+PURE_RUN_LENGTH = 1
+MIXED_RUN_LENGTH = 2
+
+
+def header():
+    comment = b"Sparse alpha channel regression"
+    return struct.pack(">If80s4sHHfHH", MAGIC, 1.0, comment, b"PICT",
+                       WIDTH, HEIGHT, 1.0, 0, 0)
+
+
+def channel_packet(encoding):
+    return bytes((0, 8, encoding, ALPHA_CHANNEL))
+
+
+def write_pic(filename, encoding, payload):
+    with open(filename, "wb") as out:
+        out.write(header())
+        out.write(channel_packet(encoding))
+        out.write(payload)
+
+
+write_pic("sparse-alpha-uncompressed.pic", UNCOMPRESSED, b"\x7f")
+write_pic("sparse-alpha-pure-rle.pic", PURE_RUN_LENGTH, b"\x01\x7f")
+write_pic("sparse-alpha-mixed-rle.pic", MIXED_RUN_LENGTH, b"\x00\x7f")