Skip to content

heifload: prevent possible int overflow for large images #4399

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Conversation

kleisauke
Copy link
Member

i.e. when the unlimited flag is set (> 16384x16384).

See: #4266 (comment).

Targets the 8.16 branch.

@jcupitt
Copy link
Member

jcupitt commented Feb 21, 2025

Ah, nice!

I noticed that heifsave.c has almost the same issue with stride:

    for (y = 0; y < area->height; y++) {
        /* Y in page. 
         */ 
        int page = (area->top + y) / heif->page_height;
        int line = (area->top + y) % heif->page_height;
        VipsPel *p = VIPS_REGION_ADDR(region, 0, area->top + y);
        VipsPel *q = heif->data + line * heif->stride;

This feels like an error in heif_image_get_plane(), though I suppose it'd be tricky for libheif to change their API.

@kleisauke
Copy link
Member Author

Ah, nice spot. heifsave.c is limited to a maximum image size of 16384x16384 (after PR #3513), but let me fix that occurrence too.

i.e. when the `unlimited` flag is set (> 16384x16384).
@kleisauke kleisauke force-pushed the 8.16-heifload-prevent-int-overflow branch from dc868c6 to 7fdde9c Compare February 21, 2025 12:21
Copy link
Member

@lovell lovell left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@kleisauke kleisauke merged commit 1beb5dd into libvips:8.16 Feb 25, 2025
6 checks passed
@kleisauke kleisauke deleted the 8.16-heifload-prevent-int-overflow branch February 25, 2025 17:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants