diff --git a/src/avif.c b/src/avif.c index f44dc49e93..c7276b8cc1 100644 --- a/src/avif.c +++ b/src/avif.c @@ -234,6 +234,7 @@ static avifResult avifImageCopyProperties(avifImage * dstImage, const avifImage dstImage->numProperties = 0; if (srcImage->numProperties != 0) { + AVIF_CHECKERR(srcImage->numProperties < SIZE_MAX / sizeof(srcImage->properties[0]), AVIF_RESULT_INVALID_ARGUMENT); dstImage->properties = (avifImageItemProperty *)avifAlloc(srcImage->numProperties * sizeof(srcImage->properties[0])); AVIF_CHECKERR(dstImage->properties != NULL, AVIF_RESULT_OUT_OF_MEMORY); memset(dstImage->properties, 0, srcImage->numProperties * sizeof(srcImage->properties[0])); diff --git a/src/codec_avm.c b/src/codec_avm.c index 2328d6e457..74b1f97b84 100644 --- a/src/codec_avm.c +++ b/src/codec_avm.c @@ -911,6 +911,9 @@ static avifResult avmCodecEncodeImage(avifCodec * codec, // monochrome. Manually set UV planes to 0.5. // avmImage is always 420 when we're monochrome + if (image->width == UINT32_MAX || image->height == UINT32_MAX) { + return AVIF_RESULT_INVALID_ARGUMENT; + } uint32_t monoUVWidth = (image->width + 1) >> 1; uint32_t monoUVHeight = (image->height + 1) >> 1; @@ -918,6 +921,9 @@ static avifResult avmCodecEncodeImage(avifCodec * codec, if (!avmImageAllocated) { uint32_t channelSize = avifImageUsesU16(image) ? 2 : 1; uint32_t monoUVRowBytes = channelSize * monoUVWidth; + if (monoUVHeight > SIZE_MAX / monoUVRowBytes) { + return AVIF_RESULT_INVALID_ARGUMENT; + } size_t monoUVSize = (size_t)monoUVHeight * monoUVRowBytes; monoUVPlane = avifAlloc(monoUVSize); diff --git a/src/codec_svt.c b/src/codec_svt.c index 2b887e85ef..97d936994c 100644 --- a/src/codec_svt.c +++ b/src/codec_svt.c @@ -282,8 +282,14 @@ static avifResult svtCodecEncodeImage(avifCodec * codec, #if SVT_AV1_CHECK_VERSION(1, 8, 0) // Simulate 4:2:0 UV planes. SVT-AV1 does not support 4:0:0 samples. + if (image->width == UINT32_MAX || image->height == UINT32_MAX) { + goto cleanup; + } const uint32_t uvWidth = (image->width + y_shift) >> y_shift; const uint32_t uvRowBytes = uvWidth * bytesPerPixel; + if (uvHeight > SIZE_MAX / uvRowBytes) { + goto cleanup; + } const size_t uvSize = (size_t)uvRowBytes * uvHeight; if (uvSize > UINT32_MAX / 2) { goto cleanup;