Skip to content

Commit 9ea9a94

Browse files
committed
Require allocation size be <= PTRDIFF_MAX
This makese it safe to cast rowBytes to ptrdiff_t. Part of the fix to #2354.
1 parent a16183b commit 9ea9a94

File tree

1 file changed

+2
-14
lines changed

1 file changed

+2
-14
lines changed

src/avif.c

Lines changed: 2 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -357,13 +357,7 @@ avifResult avifImageAllocatePlanes(avifImage * image, avifPlanesFlags planes)
357357
return AVIF_RESULT_INVALID_ARGUMENT;
358358
}
359359
const uint32_t fullRowBytes = channelSize * image->width;
360-
#if UINT32_MAX > PTRDIFF_MAX
361-
// Make sure it is safe to cast image->yuvRowBytes[i] or image->alphaRowBytes to ptrdiff_t.
362-
if (fullRowBytes > PTRDIFF_MAX) {
363-
return AVIF_RESULT_INVALID_ARGUMENT;
364-
}
365-
#endif
366-
if (image->height > SIZE_MAX / fullRowBytes) {
360+
if (image->height > PTRDIFF_MAX / fullRowBytes) {
367361
return AVIF_RESULT_INVALID_ARGUMENT;
368362
}
369363
const size_t fullSize = (size_t)fullRowBytes * image->height;
@@ -637,13 +631,7 @@ avifResult avifRGBImageAllocatePixels(avifRGBImage * rgb)
637631
return AVIF_RESULT_INVALID_ARGUMENT;
638632
}
639633
const uint32_t rowBytes = rgb->width * pixelSize;
640-
#if UINT32_MAX > PTRDIFF_MAX
641-
// Make sure it is safe to cast rgb->rowBytes to ptrdiff_t.
642-
if (rowBytes > PTRDIFF_MAX) {
643-
return AVIF_RESULT_INVALID_ARGUMENT;
644-
}
645-
#endif
646-
if (rgb->height > SIZE_MAX / rowBytes) {
634+
if (rgb->height > PTRDIFF_MAX / rowBytes) {
647635
return AVIF_RESULT_INVALID_ARGUMENT;
648636
}
649637
rgb->pixels = (uint8_t *)avifAlloc((size_t)rowBytes * rgb->height);

0 commit comments

Comments
 (0)