heifsave: limit output dimensions to match max input dimensions

lovell · lovell · commit 53257420b3d0 · 2023-06-04T08:55:57.000+01:00
diff --git a/libvips/foreign/heifsave.c b/libvips/foreign/heifsave.c
@@ -545,6 +545,13 @@ vips_foreign_save_heif_build( VipsObject *object )
 	heif->page_height = vips_image_get_page_height( heif->image );
 	heif->n_pages = heif->image->Ysize / heif->page_height;
 
+	if( (guint64) heif->page_width * heif->page_height > INT_MAX / 4 ||
+		heif->page_width > SHRT_MAX ||
+		heif->page_height > SHRT_MAX ) {
+		vips_error( "heifsave", _( "image too large" ) );
+		return( -1 );
+	}
+
 	/* Make a heif image the size of a page. We send sink_disc() output 
 	 * here and write a frame each time it fills.
 	 */
