mmp / pbrt-v4

Source code to pbrt, the ray tracer described in the forthcoming 4th edition of the "Physically Based Rendering: From Theory to Implementation" book.
https://pbrt.org
Apache License 2.0
2.89k stars 454 forks source link

Incorrect pointer addition in SpectralFilm can lead to out-of-bounds memory access. #450

Closed mpriestman closed 3 weeks ago

mpriestman commented 1 month ago

In the constructor for SpectralFilm, the splatBuffer pointer is incremented by NSpectrumSamples. I think this is wrong, and it should be incremented by nBuckets instead.

https://github.com/mmp/pbrt-v4/blob/master/src/pbrt/film.cpp#L885

When nBuckets is greater than NSpectrumSamples, then no crash, but I think you'll get incorrect behaviour as the bucketSplats arrays will be overlapping. If nBuckets is less than NSpectrumSamples, then you'll end up reading/writing off the end of the allocated memory.