fix(iff): Fix allocation bug when reading 16 bit RGBA + float z

src/iff.imageio/iffinput.cpp

@@ -785,10 +785,6 @@ IffInput::readimg()
                                           + (py * m_header.width + xmin)
                                                 * m_header.pixel_bytes();
 
-                        std::vector<uint16_t> scanline(tw
-                                                       * m_header.rgba_count);
-                        span<uint16_t> sl_span(scanline);
-
                         int sx = 0;
                         for (uint16_t px = xmin; px <= xmax; ++px, ++sx) {
                             size_t offset = (sy * tw + sx)
@@ -805,6 +801,9 @@ IffInput::readimg()
                                 = input.subspan(offset,
                                                 m_header.rgba_channels_bytes());
 
+                            uint8_t* out_p = out_dy
+                                             + sx * m_header.pixel_bytes();
+
                             for (int c = m_header.rgba_count - 1; c >= 0; --c) {
                                 uint16_t pixel;
                                 memcpy(&pixel, pixel_in.data() + c * 2, 2);
@@ -813,20 +812,10 @@ IffInput::readimg()
                                     swap_endian(&pixel);
                                 }
 
-                                if (sl_span.empty()) {
-                                    errorfmt(
-                                        "scanline span overflow at ({}, {})",
-                                        px, py);
-                                    return false;
-                                }
-
-                                sl_span.front() = pixel;
-                                sl_span         = sl_span.subspan(1);
+                                memcpy(out_p, &pixel, sizeof(pixel));
+                                out_p += sizeof(pixel);
                             }
                         }
-
-                        memcpy(out_dy, scanline.data(),
-                               tw * m_header.pixel_bytes());
                     }
                 }
             } else {

testsuite/iff/ref/out.txt

@@ -2,3 +2,8 @@ Comparing "../oiio-images/grid.tif" and "gridscanline.iff"
 PASS
 Comparing "../oiio-images/grid.tif" and "gridtile.iff"
 PASS
+Reading src/tiny_rgba16z.iff
+src/tiny_rgba16z.iff :    1 x    1, 5 channel, uint16/uint16/uint16/uint16/float iff
+    SHA-1: 1B90DDB531A3ABD137C5050BA7A955AD4F711B4C
+    channel list: R (uint16), G (uint16), B (uint16), A (uint16), Z (float)
+    tile size: 1 x 1

testsuite/iff/run.py

@@ -8,3 +8,7 @@
 command += diff_command (OIIO_TESTSUITE_IMAGEDIR+"/grid.tif", "gridscanline.iff")
 command += oiiotool (OIIO_TESTSUITE_IMAGEDIR+"/grid.tif --tile 64 64 -o gridtile.iff")
 command += diff_command (OIIO_TESTSUITE_IMAGEDIR+"/grid.tif", "gridtile.iff")
+
+# Regression test: verify reading of 16 bit rgba + float z (used to have a
+# buffer overrun)
+command += info_command("src//tiny_rgba16z.iff", hash=True)