Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix filename in fuzzing corpus so it gets parsed during regression testing #1222

Merged
merged 2 commits into from
Jul 4, 2024
Merged

Fix filename in fuzzing corpus so it gets parsed during regression testing #1222

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
73f23a1
Fix filename in fuzzing corpus so it gets parsed during regression te…
fancycode Jul 4, 2024
b34e7ac
Bring back overflow check removed in 29bc4c32514b1fc720b29dc1b0ac6cea…
fancycode Jul 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions libheif/context.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -609,6 +609,17 @@ Error HeifContext::interpret_heif_file()
uint32_t width = ispe->get_width();
uint32_t height = ispe->get_height();

uint32_t max_width_height = static_cast<uint32_t>(std::numeric_limits<int>::max());
if (width >= max_width_height || height >= max_width_height) {
std::stringstream sstr;
sstr << "Image size " << width << "x" << height << " exceeds the maximum image size "
<< m_maximum_image_size_limit << "\n";

return Error(heif_error_Memory_allocation_error,
heif_suberror_Security_limit_exceeded,
sstr.str());
}

image->set_resolution(width, height);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Simpler fix would be to set the argument type for set_resolution() to uint32_t. It is uint32_t internally anyway.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, but it's returned as int in the getters and I didn't want to introduce any potential other errors by changing the type in various places.

libheif/libheif/context.h

Lines 117 to 119 in e42b01f

int get_width() const { return m_width; }
int get_height() const { return m_height; }

Also it's returned as int in the public API:

libheif/libheif/api/libheif/heif.cc

Line 804 in e42b01f

int heif_image_handle_get_width(const struct heif_image_handle* handle)

libheif/libheif/api/libheif/heif.cc

Line 815 in e42b01f

int heif_image_handle_get_height(const struct heif_image_handle* handle)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, makes sense.

ispe_read = true;
}
Expand Down
Loading