fix(hdr): validate resolution to find corrupted files (#5256)

Signed-off-by: Larry Gritz <lg@larrygritz.com>

.gitattributes

@@ -9,3 +9,9 @@
 
 *.h linguist-language=C++
 src/libOpenImageIO/bluenoise.inc -linguist-detectable
+
+# Image test fixtures are binary and must never be CRLF-converted on
+# checkout. Some (e.g. tiny/corrupt HDR files) are mostly ASCII and would
+# otherwise be misdetected as text, breaking byte-exact reader tests.
+*.hdr binary
+*.rgbe binary

src/hdr.imageio/hdrinput.cpp

@@ -255,6 +255,11 @@ HdrInput::open(const std::string& name, ImageSpec& newspec)
     }
     m_spec.full_width  = m_spec.width;
     m_spec.full_height = m_spec.height;
+    // Validation of resolution
+    if (!check_open(m_spec, { 0, 65535, 0, 65535, 0, 1, 0, 4 })) {
+        close();
+        return false;
+    }
 
     // FIXME -- should we do anything about exposure, software,
     // pixaspect, primaries?  (N.B. rgbe.c doesn't even handle most of them)

testsuite/hdr/ref/out.txt

@@ -22,3 +22,6 @@ MtTamWest.hdr        : 1214 x  732, 3 channel, float hdr
     Stats FiniteCount: 888648 888648 888648 888648 
     Constant: No
     Monochrome: No
+oiiotool ERROR: read : "src/crash-res.hdr": hdr image resolution may not exceed 65535x65535, but the file appears to be 8888888x4. Possible corrupt input?
+Full command line was:
+> oiiotool -nostderr -oiioattrib try_all_readers 0 src/crash-res.hdr -o test.exr

testsuite/hdr/run.py

@@ -11,3 +11,6 @@ command += oiiotool (OIIO_TESTSUITE_IMAGEDIR+"/ScanLines/MtTamWest.exr -o MtTamW
 command += oiiotool ("-v -info -stats MtTamWest.hdr")
 # To double check, get stats on the original for comparison -- should be close
 command += oiiotool ("-stats " + OIIO_TESTSUITE_IMAGEDIR+"/ScanLines/MtTamWest.exr")
+
+# Regression test: invalid resolution
+command += oiiotool ("-nostderr -oiioattrib try_all_readers 0 src/crash-res.hdr -o test.exr", failureok = True)

testsuite/hdr/src/crash-res.hdr

@@ -0,0 +1,4 @@
+
+FORMAT=32-bit_rle_rgbe
+
+-Y4 +X8888888A'8

testsuite/runtest.py

@@ -337,7 +337,8 @@ def iconvert (args: str, silent: bool=False, concat: bool=True,
 
 
 # Construct a command that will run oiiotool and append its output to out.txt
-def oiiotool (args: str, silent: bool=False, concat: bool=True, failureok: bool=False) -> str:
+def oiiotool (args: str, silent: bool=False, concat: bool=True,
+             failureok: bool=False) -> str:
     cmd = (oiio_app("oiiotool") + " " + args)
     if not silent :
         cmd += redirect