[vlc-commits] [Git][videolan/vlc][master] 5 commits: demux: heif: remove unnecessary forever loop

[Felix Paul Kühne (@fkuehne)]

Felix Paul Kühne pushed to branch master at VideoLAN / VLC


Commits:
a804f139 by Steve Lhomme at 2026-06-19T10:37:56+02:00
demux: heif: remove unnecessary forever loop

There is only one iteration ever done.

- - - - -
d446ec0e by Steve Lhomme at 2026-06-19T10:37:56+02:00
demux: heif: avoid using negative values in unsigned values

- - - - -
3307d99e by Steve Lhomme at 2026-06-19T10:37:56+02:00
demux: heif: upcast minus_one variables before adding 1

If the value is 255, adding 1 in a uint8_t will end up being 0.

- - - - -
052440d0 by Steve Lhomme at 2026-06-19T10:37:56+02:00
demux: heif: set the tile pointer in one call

It is more obvious what the code is doing.

- - - - -
f7c929de by Steve Lhomme at 2026-06-19T10:37:56+02:00
demux: heif: pass the block size to check for buffer overflows

Fixes #29935

Reported-by: Cipher / Causal Security

- - - - -


1 changed file:

- modules/demux/mp4/heif.c


Changes:

=====================================
modules/demux/mp4/heif.c
=====================================
@@ -566,7 +566,7 @@ static int ReadDerivationData( demux_t *p_demux, vlc_fourcc_t type,
 static int LoadGridImage( demux_t *p_demux,
                           image_handler_t *handler,
                           uint32_t i_pic_item_id,
-                               uint8_t *p_buffer,
+                               uint8_t *p_buffer, size_t i_buffer,
                                unsigned tile, unsigned gridcols,
                                unsigned imagewidth, unsigned imageheight )
 {
@@ -610,31 +610,36 @@ static int LoadGridImage( demux_t *p_demux,
 
     const unsigned tilewidth = p_picture->format.i_visible_width;
     const unsigned tileheight = p_picture->format.i_visible_height;
-    uint8_t *dstline = p_buffer;
-    dstline += (tile / gridcols) * (imagewidth * tileheight * 4);
-    for(;1;)
+    const unsigned offsetpxw = (tile % gridcols) * tilewidth;
+    const unsigned offsetpxh = (tile / gridcols) * tileheight;
+    if (i_buffer < offsetpxh * imagewidth * 4)
+    {
+        picture_Release( p_picture );
+        return VLC_EINVAL;
+    }
+
+    size_t dst_size = i_buffer - offsetpxh * imagewidth * 4;
+    uint8_t *dstline = &p_buffer[offsetpxh * imagewidth * 4];
+    if( offsetpxw <= imagewidth )
     {
-        const unsigned offsetpxw = (tile % gridcols) * tilewidth;
-        const unsigned offsetpxh = (tile / gridcols) * tileheight;
-        if( offsetpxw > imagewidth )
-            break;
         const uint8_t *srcline = p_picture->p[0].p_pixels +
                                  p_picture->format.i_y_offset * p_picture->p[0].i_pitch +
                                  p_picture->format.i_x_offset * 4;
         unsigned tocopylines = p_picture->p[0].i_visible_lines;
-        if(offsetpxh + tocopylines >= imageheight)
+        if(offsetpxh <= imageheight  && offsetpxh + tocopylines >= imageheight)
             tocopylines = imageheight - offsetpxh;
         for(unsigned i=0; i<tocopylines; i++)
         {
             size_t tocopypx = tilewidth;
             if( offsetpxw + tilewidth > imagewidth )
                 tocopypx = imagewidth - offsetpxw;
+            if (dst_size < (offsetpxw * 4 + tocopypx * 4))
+                break;
             memcpy( &dstline[offsetpxw * 4], srcline, tocopypx * 4 );
             dstline += imagewidth * 4;
+            dst_size -= imagewidth * 4;
             srcline += p_picture->p[0].i_pitch;
         }
-
-        break;
     }
 
     picture_Release( p_picture );
@@ -701,16 +706,16 @@ static int DerivedImageAssembleGrid( demux_t *p_demux, uint32_t i_grid_item_id,
     fmt->video.i_height =
     fmt->video.i_visible_height = derivation_data.ImageGrid.output_height;
 
-    unsigned total_tiles = (derivation_data.ImageGrid.rows_minus_one + 1) *
-                           (derivation_data.ImageGrid.columns_minus_one + 1);
+    unsigned total_tiles = ((unsigned)derivation_data.ImageGrid.rows_minus_one + 1) *
+                           ((unsigned)derivation_data.ImageGrid.columns_minus_one + 1);
 
     for( uint16_t i=0; i<BOXDATA(p_refbox)->i_reference_count && i < total_tiles; i++ )
     {
         msg_Dbg( p_demux, "Loading tile %"PRIu16"/%u", i, total_tiles );
         LoadGridImage( p_demux, handler,
                        BOXDATA(p_refbox)->p_references[i].i_to_item_id,
-                       p_block->p_buffer, i,
-                       derivation_data.ImageGrid.columns_minus_one + 1,
+                       p_block->p_buffer, p_block->i_buffer, i,
+                       (unsigned)derivation_data.ImageGrid.columns_minus_one + 1,
                        derivation_data.ImageGrid.output_width,
                        derivation_data.ImageGrid.output_height );
     }



View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/b051cc9854e1ae041bd7b36b027d657de041b560...f7c929defbac9fb6d5f3e2a1b58a5cf5bfaf22fa

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/b051cc9854e1ae041bd7b36b027d657de041b560...f7c929defbac9fb6d5f3e2a1b58a5cf5bfaf22fa
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help