diff --git a/src/lib/OpenEXRCore/decoding.c b/src/lib/OpenEXRCore/decoding.c index d92cab1f4..d3bc438ba 100644 --- a/src/lib/OpenEXRCore/decoding.c +++ b/src/lib/OpenEXRCore/decoding.c @@ -590,7 +590,25 @@ exr_decoding_run ( (part->storage_mode == EXR_STORAGE_DEEP_SCANLINE || part->storage_mode == EXR_STORAGE_DEEP_TILED)) { - if (part->comp_type == EXR_COMPRESSION_NONE && + if (part->comp_type != EXR_COMPRESSION_NONE && + decode->packed_sample_count_table == NULL && + decode->sample_count_table != NULL) + { + /* A compressed deep chunk declared a zero-length (absent) + * packed sample-count table, so decompress_data() above was + * never invoked and decode->sample_count_table, which was + * allocated to hold the full decompressed table, was left + * uninitialized. Treat an absent table as all-zero sample + * counts instead of reading uninitialized heap memory in + * unpack_sample_table(). + */ + memset ( + decode->sample_count_table, + 0, + decode->sample_count_alloc_size); + } + else if ( + part->comp_type == EXR_COMPRESSION_NONE && decode->sample_count_table != decode->packed_sample_count_table) { /* Check that uncompressed data can be copied in safely.