diff -Naur blender-2.68a-original/source/blender/avi/CMakeLists.txt blender-2.68a/source/blender/avi/CMakeLists.txt

--- blender-2.68a-original/source/blender/avi/CMakeLists.txt	2012-10-07 02:27:31.000000000 -0400

+++ blender-2.68a/source/blender/avi/CMakeLists.txt	2022-04-04 07:18:55.810153370 -0400

@@ -26,6 +26,7 @@

 set(INC 

 	.

 	../blenlib

+	../imbuf

 	../../../intern/guardedalloc

 )

diff -Naur blender-2.68a-original/source/blender/avi/intern/avi.c blender-2.68a/source/blender/avi/intern/avi.c

--- blender-2.68a-original/source/blender/avi/intern/avi.c	2013-05-28 15:35:26.000000000 -0400

+++ blender-2.68a/source/blender/avi/intern/avi.c	2022-04-04 08:51:43.768676218 -0400

@@ -285,13 +285,15 @@

 	fseek(movie.fp, movie.header->size - 14 * 4, SEEK_CUR);

-	if (movie.header->Streams < 1) {

-		DEBUG_PRINT("streams less than 1\n");

+	/* Limit number of streams to some reasonable amount to prevent

+	 * buffer oveflow vulnerabilities. */

+	if (movie.header->Streams < 1 || movie.header->Streams > 65536) {

+		DEBUG_PRINT("Number of streams should be in range 1-65536\n");

 		fclose(movie.fp);

 		return 0;

 	}

-	movie.streams = (AviStreamRec *) MEM_callocN(sizeof(AviStreamRec) * movie.header->Streams, "moviestreams");

+	movie.streams = (AviStreamRec *) MEM_calloc_arrayN(movie.header->Streams, sizeof(AviStreamRec), "moviestreams");

 	for (temp = 0; temp < movie.header->Streams; temp++) {

@@ -486,12 +488,14 @@

 	fseek(movie->fp, movie->header->size - 14 * 4, SEEK_CUR);

-	if (movie->header->Streams < 1) {

-		DEBUG_PRINT("streams less than 1\n");

+	/* Limit number of streams to some reasonable amount to prevent

+	 * buffer oveflow vulnerabilities. */

+	if (movie->header->Streams < 1 || movie->header->Streams > 65536) {

+		DEBUG_PRINT("Number of streams should be in range 1-65536\n");

 		return AVI_ERROR_FORMAT;

 	}

-	movie->streams = (AviStreamRec *) MEM_callocN(sizeof(AviStreamRec) * movie->header->Streams, "moviestreams");

+	movie->streams = (AviStreamRec *) MEM_calloc_arrayN(movie->header->Streams, sizeof(AviStreamRec), "moviestreams");

 	for (temp = 0; temp < movie->header->Streams; temp++) {

@@ -689,7 +693,8 @@

 void *AVI_read_frame(AviMovie *movie, AviFormat format, int frame, int stream)

 {

-	int cur_frame = -1, temp, i = 0, rewind = 1;

+	int cur_frame = -1, i = 0, rewind = 1;

+	size_t size;

 	void *buffer;

 	/* Retrieve the record number of the desired frame in the index 

@@ -720,16 +725,16 @@

 	fseek(movie->fp, movie->read_offset + movie->entries[i - 1].Offset, SEEK_SET);

-	temp = GET_FCC(movie->fp);

-	buffer = MEM_mallocN(temp, "readbuffer");

+	size = GET_FCC(movie->fp);

+	buffer = MEM_mallocN(size, "readbuffer");

-	if (fread(buffer, 1, temp, movie->fp) != temp) {

+	if (fread(buffer, 1, size, movie->fp) != size) {

 		MEM_freeN(buffer);

 		return NULL;

 	}

-	buffer = avi_format_convert(movie, stream, buffer, movie->streams[stream].format, format, &temp);

+	buffer = avi_format_convert(movie, stream, buffer, movie->streams[stream].format, format, &size);

 	return buffer;

 }

@@ -801,6 +806,13 @@

 	movie->header->Reserved[2] = 0;

 	movie->header->Reserved[3] = 0;

+	/* Limit number of streams to some reasonable amount to prevent

+	 * buffer oveflow vulnerabilities. */

+	if (movie->header->Streams < 0 || movie->header->Streams > 65536) {

+		DEBUG_PRINT("Number of streams should be in range 0-65536\n");

+		return AVI_ERROR_FORMAT;

+	}

+

 	movie->streams = (AviStreamRec *) MEM_mallocN(sizeof(AviStreamRec) * movie->header->Streams, "moviestreams");

 	va_start(ap, streams);

@@ -962,7 +974,6 @@

 	int64_t rec_off;

 	AviFormat format;

 	void *buffer;

-	int size;

 	if (frame_num < 0)

 		return AVI_ERROR_OPTION;

@@ -993,6 +1004,7 @@

 	for (stream = 0; stream < movie->header->Streams; stream++) {

 		unsigned int tbuf = 0;

+		size_t size;

 		format = va_arg(ap, AviFormat);

 		buffer = va_arg(ap, void *);

diff -Naur blender-2.68a-original/source/blender/avi/intern/avi_codecs.c blender-2.68a/source/blender/avi/intern/avi_codecs.c

--- blender-2.68a-original/source/blender/avi/intern/avi_codecs.c	2012-10-07 02:27:31.000000000 -0400

+++ blender-2.68a/source/blender/avi/intern/avi_codecs.c	2022-04-04 07:23:09.248184710 -0400

@@ -39,7 +39,7 @@

 #include "avi_mjpeg.h"

 #include "avi_rgb32.h"

-void *avi_format_convert(AviMovie *movie, int stream, void *buffer, AviFormat from, AviFormat to, int *size)

+void *avi_format_convert(AviMovie *movie, int stream, void *buffer, AviFormat from, AviFormat to, size_t *size)

 {

 	if (from == to)

 		return buffer;

diff -Naur blender-2.68a-original/source/blender/avi/intern/avi_intern.h blender-2.68a/source/blender/avi/intern/avi_intern.h

--- blender-2.68a-original/source/blender/avi/intern/avi_intern.h	2013-04-17 21:52:38.000000000 -0400

+++ blender-2.68a/source/blender/avi/intern/avi_intern.h	2022-04-04 07:23:24.235363969 -0400

@@ -59,7 +59,7 @@

 	putc(ch2[1], fp); \

 } (void)0

-void *avi_format_convert(AviMovie *movie, int stream, void *buffer, AviFormat from, AviFormat to, int *size);

+void *avi_format_convert(AviMovie *movie, int stream, void *buffer, AviFormat from, AviFormat to, size_t *size);

 int avi_get_data_id(AviFormat format, int stream);

 int avi_get_format_type(AviFormat format);

diff -Naur blender-2.68a-original/source/blender/avi/intern/avi_mjpeg.c blender-2.68a/source/blender/avi/intern/avi_mjpeg.c

--- blender-2.68a-original/source/blender/avi/intern/avi_mjpeg.c	2012-12-23 08:57:09.000000000 -0500

+++ blender-2.68a/source/blender/avi/intern/avi_mjpeg.c	2022-04-04 14:04:29.614968727 -0400

@@ -39,6 +39,8 @@

 #include "MEM_guardedalloc.h"

+#include "IMB_imbuf.h"

+

 #include "jpeglib.h"

 #include "jerror.h"

@@ -46,10 +48,10 @@

 #define PADUP(num, amt) ((num + (amt - 1)) & ~(amt - 1))

-static void jpegmemdestmgr_build(j_compress_ptr cinfo, unsigned char *buffer, int bufsize);

-static void jpegmemsrcmgr_build(j_decompress_ptr dinfo, unsigned char *buffer, int bufsize);

+static void jpegmemdestmgr_build(j_compress_ptr cinfo, unsigned char *buffer, size_t bufsize);

+static void jpegmemsrcmgr_build(j_decompress_ptr dinfo, unsigned char *buffer, size_t bufsize);

-static int numbytes;

+static size_t numbytes;

 static void add_huff_table(j_decompress_ptr dinfo, JHUFF_TBL **htblptr, const UINT8 *bits, const UINT8 *val)

 {

@@ -153,10 +155,9 @@

 	               bits_ac_chrominance, val_ac_chrominance);

 }

-static int Decode_JPEG(unsigned char *inBuffer, unsigned char *outBuffer, unsigned int width, unsigned int height, int bufsize)

+static int Decode_JPEG(unsigned char *inBuffer, unsigned char *outBuffer, unsigned int width, unsigned int height, size_t bufsize)

 {

-	int rowstride;

-	unsigned int y;

+	size_t rowstride, y;

 	struct jpeg_decompress_struct dinfo;

 	struct jpeg_error_mgr jerr;

@@ -206,10 +207,10 @@

 	return 1;

 }

-static void Compress_JPEG(int quality, unsigned char *outbuffer, const unsigned char *inBuffer, int width, int height, int bufsize)

+static void Compress_JPEG(int quality, unsigned char *outbuffer, const unsigned char *inBuffer, int width, int height, size_t bufsize)

 {

-	int i, rowstride;

-	unsigned int y;

+	int i;

+	size_t rowstride, y;

 	struct jpeg_compress_struct cinfo;

 	struct jpeg_error_mgr jerr;

 	unsigned char marker[60];

@@ -270,7 +271,7 @@

 static void interlace(unsigned char *to, unsigned char *from, int width, int height)

 {

-	int i, rowstride = width * 3;

+	size_t i, rowstride = width * 3;

 	for (i = 0; i < height; i++) {

 		if (i & 1)

@@ -282,7 +283,7 @@

 static void deinterlace(int odd, unsigned char *to, unsigned char *from, int width, int height)

 {

-	int i, rowstride = width * 3;

+	size_t i, rowstride = width * 3;

 	for (i = 0; i < height; i++) {

 		if ((i & 1) == odd)

@@ -346,22 +347,27 @@

 	}

 }

-void *avi_converter_from_mjpeg(AviMovie *movie, int stream, unsigned char *buffer, int *size)

+void *avi_converter_from_mjpeg(AviMovie *movie, int stream, unsigned char *buffer, size_t *size)

 {

 	int deint;

 	unsigned char *buf;

 	(void)stream; /* unused */

-	buf = MEM_mallocN(movie->header->Height * movie->header->Width * 3, "avi.avi_converter_from_mjpeg 1");

+	buf = imb_alloc_pixels(movie->header->Height, movie->header->Width, 3, sizeof(unsigned char), "avi.avi_converter_from_mjpeg 1");

+	if (!buf) {

+		return NULL;

+	}

 	deint = check_and_decode_jpeg(buffer, buf, movie->header->Width, movie->header->Height, *size);

 	MEM_freeN(buffer);

 	if (deint) {

-		buffer = MEM_mallocN(movie->header->Height * movie->header->Width * 3, "avi.avi_converter_from_mjpeg 2");

-		interlace(buffer, buf, movie->header->Width, movie->header->Height);

+		buffer = imb_alloc_pixels(movie->header->Height, movie->header->Width, 3, sizeof(unsigned char), "avi.avi_converter_from_mjpeg 2");

+		if (buffer) {

+			interlace(buffer, buf, movie->header->Width, movie->header->Height);

+		}

 		MEM_freeN(buf);

 		buf = buffer;

@@ -370,43 +376,50 @@

 	return buf;

 }

-void *avi_converter_to_mjpeg(AviMovie *movie, int stream, unsigned char *buffer, int *size)

+void *avi_converter_to_mjpeg(AviMovie *movie, int stream, unsigned char *buffer, size_t *size)

 {

 	unsigned char *buf;

-	int bufsize = *size;

+	size_t bufsize = *size;

 	numbytes = 0;

 	*size = 0;

-	buf = MEM_mallocN(movie->header->Height * movie->header->Width * 3, "avi.avi_converter_to_mjpeg 1");

+	buf = imb_alloc_pixels(movie->header->Height, movie->header->Width, 3, sizeof(unsigned char), "avi.avi_converter_to_mjpeg 1");

+	if (!buf) {

+		return NULL;

+	}

+

 	if (!movie->interlace) {

 		check_and_compress_jpeg(movie->streams[stream].sh.Quality / 100,

 		                        buf, buffer,

 		                        movie->header->Width,

 		                        movie->header->Height,

 		                        bufsize);

+		*size += numbytes;

 	}

 	else {

 		deinterlace(movie->odd_fields, buf, buffer, movie->header->Width, movie->header->Height);

 		MEM_freeN(buffer);

 		buffer = buf;

-		buf = MEM_mallocN(movie->header->Height * movie->header->Width * 3, "avi.avi_converter_to_mjpeg 2");

-	

-		check_and_compress_jpeg(movie->streams[stream].sh.Quality / 100,

-		                        buf, buffer,

-		                        movie->header->Width,

-		                        movie->header->Height / 2,

-		                        bufsize / 2);

-		*size += numbytes;

-		numbytes = 0;

-		check_and_compress_jpeg(movie->streams[stream].sh.Quality / 100,

-		                        buf + *size, buffer + (movie->header->Height / 2) * movie->header->Width * 3,

-		                        movie->header->Width,

-		                        movie->header->Height / 2,

-		                        bufsize / 2);

+		buf = imb_alloc_pixels(movie->header->Height, movie->header->Width, 3, sizeof(unsigned char), "avi.avi_converter_to_mjpeg 1");

+

+		if (buf) {

+			Compress_JPEG(movie->streams[stream].sh.Quality / 100,

+				      buf, buffer,

+				      movie->header->Width,

+				      movie->header->Height / 2,

+				      bufsize / 2);

+			*size += numbytes;

+			numbytes = 0;

+			Compress_JPEG(movie->streams[stream].sh.Quality / 100,

+				      buf + *size, buffer + (size_t)(movie->header->Height / 2) * (size_t)movie->header->Width * 3,

+				      movie->header->Width,

+				      movie->header->Height / 2,

+				      bufsize / 2);

+			*size += numbytes;

+		}

 	}

-	*size += numbytes;

 	MEM_freeN(buffer);

 	return buf;

@@ -433,7 +446,7 @@

 	MEM_freeN(cinfo->dest);

 }

-static void jpegmemdestmgr_build(j_compress_ptr cinfo, unsigned char *buffer, int bufsize)

+static void jpegmemdestmgr_build(j_compress_ptr cinfo, unsigned char *buffer, size_t bufsize)

 {

 	cinfo->dest = MEM_mallocN(sizeof(*(cinfo->dest)), "avi.jpegmemdestmgr_build");

@@ -486,7 +499,7 @@

 	MEM_freeN(dinfo->src);

 }

-static void jpegmemsrcmgr_build(j_decompress_ptr dinfo, unsigned char *buffer, int bufsize)

+static void jpegmemsrcmgr_build(j_decompress_ptr dinfo, unsigned char *buffer, size_t bufsize)

 {

 	dinfo->src = MEM_mallocN(sizeof(*(dinfo->src)), "avi.jpegmemsrcmgr_build");

diff -Naur blender-2.68a-original/source/blender/avi/intern/avi_mjpeg.h blender-2.68a/source/blender/avi/intern/avi_mjpeg.h

--- blender-2.68a-original/source/blender/avi/intern/avi_mjpeg.h	2013-04-17 21:52:38.000000000 -0400

+++ blender-2.68a/source/blender/avi/intern/avi_mjpeg.h	2022-04-04 07:29:10.605507637 -0400

@@ -32,7 +32,7 @@

 #ifndef __AVI_MJPEG_H__

 #define __AVI_MJPEG_H__

-void *avi_converter_from_mjpeg(AviMovie *movie, int stream, unsigned char *buffer, int *size);

-void *avi_converter_to_mjpeg(AviMovie *movie, int stream, unsigned char *buffer, int *size);

+void *avi_converter_from_mjpeg(AviMovie *movie, int stream, unsigned char *buffer, size_t *size);

+void *avi_converter_to_mjpeg(AviMovie *movie, int stream, unsigned char *buffer, size_t *size);

 #endif /* __AVI_MJPEG_H__ */

diff -Naur blender-2.68a-original/source/blender/avi/intern/avi_rgb32.c blender-2.68a/source/blender/avi/intern/avi_rgb32.c

--- blender-2.68a-original/source/blender/avi/intern/avi_rgb32.c	2012-10-07 02:27:31.000000000 -0400

+++ blender-2.68a/source/blender/avi/intern/avi_rgb32.c	2022-04-04 08:59:10.860988656 -0400

@@ -37,23 +37,29 @@

 #include "MEM_guardedalloc.h"

+#include "IMB_imbuf.h"

+

 #include "AVI_avi.h"

 #include "avi_rgb32.h"

-void *avi_converter_from_rgb32(AviMovie *movie, int stream, unsigned char *buffer, int *size)

+void *avi_converter_from_rgb32(AviMovie *movie, int stream, unsigned char *buffer, size_t *size)

 {

-	int y, x, rowstridea, rowstrideb;

+	size_t y, rowstridea, rowstrideb;

 	unsigned char *buf;

 	(void)stream; /* unused */

-	buf = MEM_mallocN(movie->header->Height * movie->header->Width * 3, "fromrgb32buf");

-	*size = movie->header->Height * movie->header->Width * 3;

+	*size = (size_t)movie->header->Height * (size_t)movie->header->Width * 3;

+	buf = imb_alloc_pixels(movie->header->Height, movie->header->Width, 3, sizeof(unsigned char), "fromrgb32buf");

+	if (!buf) {

+		return NULL;

+	}

 	rowstridea = movie->header->Width * 3;

 	rowstrideb = movie->header->Width * 4;

-	for (y = 0; y < movie->header->Height; y++) {

+	for ( y = 0; y < movie->header->Height; y++) {

+		size_t x;

 		for (x = 0; x < movie->header->Width; x++) {

 			buf[y * rowstridea + x * 3 + 0] = buffer[y * rowstrideb + x * 4 + 3];

 			buf[y * rowstridea + x * 3 + 1] = buffer[y * rowstrideb + x * 4 + 2];

@@ -66,21 +72,24 @@

 	return buf;

 }

-void *avi_converter_to_rgb32(AviMovie *movie, int stream, unsigned char *buffer, int *size)

+void *avi_converter_to_rgb32(AviMovie *movie, int stream, unsigned char *buffer, size_t *size)

 {

-	int i;

+	size_t i;

 	unsigned char *buf;

 	unsigned char *to, *from;

 	(void)stream; /* unused */

-	buf = MEM_mallocN(movie->header->Height * movie->header->Width * 4, "torgb32buf");

-	*size = movie->header->Height * movie->header->Width * 4;

+	*size = (size_t)movie->header->Height * (size_t)movie->header->Width * 4;

+	buf = imb_alloc_pixels(movie->header->Height, movie->header->Width, 3, sizeof(unsigned char), "torgb32buf");

+	if (!buf) {

+		return NULL;

+	}

 	memset(buf, 255, *size);

 	to = buf; from = buffer;

-	i = movie->header->Height * movie->header->Width;

+	i = (size_t)movie->header->Height * (size_t)movie->header->Width;

 	while (i--) {

 		memcpy(to, from, 3);

diff -Naur blender-2.68a-original/source/blender/avi/intern/avi_rgb32.h blender-2.68a/source/blender/avi/intern/avi_rgb32.h

--- blender-2.68a-original/source/blender/avi/intern/avi_rgb32.h	2012-10-07 02:27:31.000000000 -0400

+++ blender-2.68a/source/blender/avi/intern/avi_rgb32.h	2022-04-04 07:41:09.931118849 -0400

@@ -32,7 +32,7 @@

 #ifndef __AVI_RGB32_H__

 #define __AVI_RGB32_H__

-void *avi_converter_from_rgb32(AviMovie *movie, int stream, unsigned char *buffer, int *size);

-void *avi_converter_to_rgb32(AviMovie *movie, int stream, unsigned char *buffer, int *size);

+void *avi_converter_from_rgb32(AviMovie *movie, int stream, unsigned char *buffer, size_t *size);

+void *avi_converter_to_rgb32(AviMovie *movie, int stream, unsigned char *buffer, size_t *size);

 #endif /* __AVI_RGB32_H__ */

diff -Naur blender-2.68a-original/source/blender/avi/intern/avi_rgb.c blender-2.68a/source/blender/avi/intern/avi_rgb.c

--- blender-2.68a-original/source/blender/avi/intern/avi_rgb.c	2012-11-17 21:41:55.000000000 -0500

+++ blender-2.68a/source/blender/avi/intern/avi_rgb.c	2022-04-04 13:54:10.675622194 -0400

@@ -40,11 +40,12 @@

 #include "AVI_avi.h"

 #include "avi_rgb.h"

+#include "IMB_imbuf.h"

+

 /* implementation */

-void *avi_converter_from_avi_rgb(AviMovie *movie, int stream, unsigned char *buffer, int *size)

+void *avi_converter_from_avi_rgb(AviMovie *movie, int stream, unsigned char *buffer, size_t *size)

 {

-	int x, y, i, rowstride;

 	unsigned char *buf;

 	AviBitmapInfoHeader *bi;

 	short bits = 32;

@@ -60,33 +61,36 @@

 #ifdef __BIG_ENDIAN__

 		unsigned char  *pxla;

 #endif

-		

-		buf = MEM_mallocN(movie->header->Height * movie->header->Width * 3, "fromavirgbbuf");

+		buf = imb_alloc_pixels(movie->header->Height, movie->header->Width, 3, sizeof(unsigned char),  "fromavirgbbuf");

+

+		if (buf) {

+			size_t y = movie->header->Height;

+			to = buf;

-		y = movie->header->Height;

-		to = buf;

+			while (y--) {

+				size_t x;

+

+				pxl = (unsigned short *) (buffer + y * movie->header->Width * 2);

-		while (y--) {

-			pxl = (unsigned short *) (buffer + y * movie->header->Width * 2);

-			

 #ifdef __BIG_ENDIAN__

-			pxla = (unsigned char *)pxl;

+				pxla = (unsigned char *)pxl;

 #endif

-			x = movie->header->Width;

-			while (x--) {

+				x = movie->header->Width;

+				while (x--) {

 #ifdef __BIG_ENDIAN__

-				i = pxla[0];

-				pxla[0] = pxla[1];

-				pxla[1] = i;

-	

-				pxla += 2;

+					int i = pxla[0];

+					pxla[0] = pxla[1];

+					pxla[1] = i;

+

+					pxla += 2;

 #endif

-			

-				*(to++) = ((*pxl >> 10) & 0x1f) * 8;

-				*(to++) = ((*pxl >> 5) & 0x1f) * 8;

-				*(to++) = (*pxl & 0x1f) * 8;

-				pxl++;

+

+					*(to++) = ((*pxl >> 10) & 0x1f) * 8;

+					*(to++) = ((*pxl >> 5) & 0x1f) * 8;

+					*(to++) = (*pxl & 0x1f) * 8;

+					pxl++;

+				}

 			}

 		}

@@ -95,30 +99,33 @@

 		return buf;

 	}

 	else {

-		buf = MEM_mallocN(movie->header->Height * movie->header->Width * 3, "fromavirgbbuf");

-	

-		rowstride = movie->header->Width * 3;

-		if ((bits != 16) && (movie->header->Width % 2)) rowstride++;

-	

-		for (y = 0; y < movie->header->Height; y++) {

-			memcpy(&buf[y * movie->header->Width * 3], &buffer[((movie->header->Height - 1) - y) * rowstride], movie->header->Width * 3);

-		}

+		buf = imb_alloc_pixels(movie->header->Height, movie->header->Width, 3, sizeof(unsigned char),  "fromavirgbbuf");

-		for (y = 0; y < movie->header->Height * movie->header->Width * 3; y += 3) {

-			i = buf[y];

-			buf[y] = buf[y + 2];

-			buf[y + 2] = i;

+		if (buf) {

+			size_t y;

+			size_t rowstride = movie->header->Width * 3;

+			if ((bits != 16) && (movie->header->Width % 2)) rowstride++;

+

+			for (y = 0; y < movie->header->Height; y++) {

+				memcpy(&buf[y * movie->header->Width * 3], &buffer[((movie->header->Height - 1) - y) * rowstride], movie->header->Width * 3);

+			}

+

+			for (y = 0; y < (size_t)movie->header->Height * (size_t)movie->header->Width * 3; y += 3) {

+				int i = buf[y];

+				buf[y] = buf[y + 2];

+				buf[y + 2] = i;

+			}

 		}

-	

+

 		MEM_freeN(buffer);

-	

+

 		return buf;

 	}

 }

-void *avi_converter_to_avi_rgb(AviMovie *movie, int stream, unsigned char *buffer, int *size)

+void *avi_converter_to_avi_rgb(AviMovie *movie, int stream, unsigned char *buffer, size_t *size)

 {

-	int y, x, i, rowstride;

+	size_t y, rowstride;

 	unsigned char *buf;

 	(void)stream; /* unused */

@@ -136,8 +143,9 @@

 	}

 	for (y = 0; y < movie->header->Height; y++) {

+		size_t x;

 		for (x = 0; x < movie->header->Width * 3; x += 3) {

-			i = buf[y * rowstride + x];

+			int i = buf[y * rowstride + x];

 			buf[y * rowstride + x] = buf[y * rowstride + x + 2];

 			buf[y * rowstride + x + 2] = i;

 		}

diff -Naur blender-2.68a-original/source/blender/avi/intern/avi_rgb.h blender-2.68a/source/blender/avi/intern/avi_rgb.h

--- blender-2.68a-original/source/blender/avi/intern/avi_rgb.h	2012-10-07 02:27:31.000000000 -0400

+++ blender-2.68a/source/blender/avi/intern/avi_rgb.h	2022-04-04 07:36:15.196590519 -0400

@@ -32,7 +32,7 @@

 #ifndef __AVI_RGB_H__

 #define __AVI_RGB_H__

-void *avi_converter_from_avi_rgb(AviMovie *movie, int stream, unsigned char *buffer, int *size);

-void *avi_converter_to_avi_rgb(AviMovie *movie, int stream, unsigned char *buffer, int *size);

+void *avi_converter_from_avi_rgb(AviMovie *movie, int stream, unsigned char *buffer, size_t *size);

+void *avi_converter_to_avi_rgb(AviMovie *movie, int stream, unsigned char *buffer, size_t *size);

 #endif /* __AVI_RGB_H__ */

diff -Naur blender-2.68a-original/source/blender/imbuf/IMB_imbuf.h blender-2.68a/source/blender/imbuf/IMB_imbuf.h

--- blender-2.68a-original/source/blender/imbuf/IMB_imbuf.h	2013-05-12 05:14:13.000000000 -0400

+++ blender-2.68a/source/blender/imbuf/IMB_imbuf.h	2022-04-04 07:41:29.491353010 -0400

@@ -503,6 +503,12 @@

 int IMB_metadata_change_field(struct ImBuf *img, const char *key, const char *field);

 /* exported for image tools in blender, to quickly allocate 32 bits rect */

+void *imb_alloc_pixels(unsigned int x,

+                       unsigned int y,

+                       unsigned int channels,

+                       size_t typesize,

+                       const char *name);

+

 short imb_addrectImBuf(struct ImBuf *ibuf);

 void imb_freerectImBuf(struct ImBuf *ibuf);

diff -Naur blender-2.68a-original/source/blender/imbuf/intern/allocimbuf.c blender-2.68a/source/blender/imbuf/intern/allocimbuf.c

--- blender-2.68a-original/source/blender/imbuf/intern/allocimbuf.c	2012-12-19 10:02:51.000000000 -0500

+++ blender-2.68a/source/blender/imbuf/intern/allocimbuf.c	2022-04-04 08:59:57.627543513 -0400

@@ -193,14 +193,11 @@

 short addzbufImBuf(ImBuf *ibuf)

 {

-	int size;

-	

 	if (ibuf == NULL) return FALSE;

 	IMB_freezbufImBuf(ibuf);

-	size = ibuf->x * ibuf->y * sizeof(unsigned int);

-	if ((ibuf->zbuf = MEM_mapallocN(size, "addzbufImBuf"))) {

+	if ((ibuf->zbuf = imb_alloc_pixels(ibuf->x, ibuf->y, 1, sizeof(unsigned int), "addzbufImBuf"))) {

 		ibuf->mall |= IB_zbuf;

 		ibuf->flags |= IB_zbuf;

 		return TRUE;

@@ -211,14 +208,11 @@

 short addzbuffloatImBuf(ImBuf *ibuf)

 {

-	int size;

-	

 	if (ibuf == NULL) return FALSE;

 	IMB_freezbuffloatImBuf(ibuf);

-	size = ibuf->x * ibuf->y * sizeof(float);

-	if ((ibuf->zbuf_float = MEM_mapallocN(size, "addzbuffloatImBuf"))) {

+	if ((ibuf->zbuf_float = imb_alloc_pixels(ibuf->x, ibuf->y, 1, sizeof(float), "addzbuffloatImBuf"))) {

 		ibuf->mall |= IB_zbuffloat;

 		ibuf->flags |= IB_zbuffloat;

 		return TRUE;

@@ -287,20 +281,34 @@

 	return TRUE;

 }

+void *imb_alloc_pixels(unsigned int x,

+                       unsigned int y,

+                       unsigned int channels,

+                       size_t typesize,

+                       const char *name)

+{

+	size_t size;

+

+	/* Protect against buffer overflow vulnerabilities from files specifying

+	 * a width and height that overflow and alloc too little memory. */

+	if (!((uint64_t)x * (uint64_t)y < (SIZE_MAX / (channels * typesize)))) {

+		return NULL;

+	}

+

+	size = (size_t)x * (size_t)y * (size_t)channels * typesize;

+	return MEM_mapallocN(size, name);

+}

+

 short imb_addrectfloatImBuf(ImBuf *ibuf)

 {

-	int size;

-	

 	if (ibuf == NULL) return FALSE;

 	if (ibuf->rect_float)

 		imb_freerectfloatImBuf(ibuf);  /* frees mipmap too, hrm */

-	size = ibuf->x * ibuf->y;

-	size = size * 4 * sizeof(float);

 	ibuf->channels = 4;

-	if ((ibuf->rect_float = MEM_mapallocN(size, "imb_addrectfloatImBuf"))) {

+	if ((ibuf->rect_float = imb_alloc_pixels(ibuf->x, ibuf->y, 4, sizeof(float), "imb_addrectfloatImBuf"))) {

 		ibuf->mall |= IB_rectfloat;

 		ibuf->flags |= IB_rectfloat;

 		return TRUE;

@@ -312,8 +320,6 @@

 /* question; why also add zbuf? */

 short imb_addrectImBuf(ImBuf *ibuf)

 {

-	int size;

-

 	if (ibuf == NULL) return FALSE;

 	/* don't call imb_freerectImBuf, it frees mipmaps, this call is used only too give float buffers display */

@@ -321,10 +327,7 @@

 		MEM_freeN(ibuf->rect);

 	ibuf->rect = NULL;

-	size = ibuf->x * ibuf->y;

-	size = size * sizeof(unsigned int);

-

-	if ((ibuf->rect = MEM_mapallocN(size, "imb_addrectImBuf"))) {

+	if ((ibuf->rect = imb_alloc_pixels(ibuf->x, ibuf->y, 4, sizeof(unsigned char), "imb_addrectImBuf"))) {

 		ibuf->mall |= IB_rect;

 		ibuf->flags |= IB_rect;

 		if (ibuf->planes > 32) return (addzbufImBuf(ibuf));

diff -Naur blender-2.68a-original/source/blender/imbuf/intern/bmp.c blender-2.68a/source/blender/imbuf/intern/bmp.c

--- blender-2.68a-original/source/blender/imbuf/intern/bmp.c	2013-03-17 06:26:23.000000000 -0400

+++ blender-2.68a/source/blender/imbuf/intern/bmp.c	2022-04-04 09:04:24.666711767 -0400

@@ -125,7 +125,7 @@

 {

 	struct ImBuf *ibuf = NULL;

 	BMPINFOHEADER bmi;

-	int x, y, depth, skip, i;

+	int x, y, depth, skip;

 	unsigned char *bmp, *rect;

 	unsigned short col;

 	double xppm, yppm;

@@ -163,10 +163,15 @@

 	}

 	else {

 		ibuf = IMB_allocImBuf(x, y, depth, IB_rect);

+		if (!ibuf) {

+			return NULL;

+		}

+

 		bmp = mem + skip;

 		rect = (unsigned char *) ibuf->rect;

 		if (depth == 16) {

+			size_t i;

 			for (i = x * y; i > 0; i--) {

 				col = bmp[0] + (bmp[1] << 8);

 				rect[0] = ((col >> 10) & 0x1f) << 3;

@@ -179,8 +184,9 @@

 		}

 		else if (depth == 24) {

+			size_t i;

 			for (i = y; i > 0; i--) {

-				int j;