Commit d94d511d authored by David Gobbi's avatar David Gobbi
Browse files

Fix a memory overrun in vtkImagePointDataIterator.

If the stencil extent was smaller than the image extent, then the code
incremented the span list pointer upon reaching the first voxel within
the stencil extent, even though the pointer was already at the correct
location for the first voxel in the stencil extent.  The extra increment
could lead to a buffer overrun and unpredicable behavior resulting in
random crashes.
parent 544d6963
...@@ -141,7 +141,7 @@ void vtkImagePointDataIterator::Initialize( ...@@ -141,7 +141,7 @@ void vtkImagePointDataIterator::Initialize(
if (stencil) if (stencil)
{ {
this->HasStencil = true; this->HasStencil = true;
this->InStencil = true; this->InStencil = false;
this->SpanIndex = 0; this->SpanIndex = 0;
int stencilExtent[6]; int stencilExtent[6];
...@@ -175,9 +175,13 @@ void vtkImagePointDataIterator::Initialize( ...@@ -175,9 +175,13 @@ void vtkImagePointDataIterator::Initialize(
if (yOffset < 0) if (yOffset < 0)
{ {
this->Extent[2] = stencilExtent[2]; this->Extent[2] = stencilExtent[2];
// starting before start of stencil: subtract the increment that
// will be added in NextSpan() upon entry into stencil extent
startOffset -= 1;
} }
else else
{ {
// starting partway into the stencil, so add an offset
startOffset += yOffset; startOffset += yOffset;
} }
...@@ -190,9 +194,16 @@ void vtkImagePointDataIterator::Initialize( ...@@ -190,9 +194,16 @@ void vtkImagePointDataIterator::Initialize(
if (zOffset < 0) if (zOffset < 0)
{ {
this->Extent[4] = stencilExtent[4]; this->Extent[4] = stencilExtent[4];
// starting before start of stencil: subtract the increment that
// will be added in NextSpan() upon entry into stencil extent
if (yOffset >= 0)
{
startOffset -= 1 + this->SpanSliceEndIncrement;
}
} }
else else
{ {
// starting partway into the stencil, so add an offset
startOffset += zOffset*this->SpanSliceIncrement; startOffset += zOffset*this->SpanSliceIncrement;
} }
...@@ -212,8 +223,13 @@ void vtkImagePointDataIterator::Initialize( ...@@ -212,8 +223,13 @@ void vtkImagePointDataIterator::Initialize(
vtkImageStencilIteratorFriendship::GetExtentLists(stencil) + vtkImageStencilIteratorFriendship::GetExtentLists(stencil) +
startOffset; startOffset;
// Holds the current position within the span list for the current row // Get the current position within the span list for the current row
this->SetSpanState(this->Extent[0]); if (yOffset >= 0 && zOffset >= 0)
{
// If starting within stencil extent, check stencil immediately
this->InStencil = true;
this->SetSpanState(this->Extent[0]);
}
} }
else else
{ {
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment