[vlc-commits] [Git][videolan/vlc][master] demux: heif: check the grid offset for overflow

[Steve Lhomme (@robUx4)]

Steve Lhomme pushed to branch master at VideoLAN / VLC


Commits:
8a47770f by Steve Lhomme at 2026-11-02T11:48:03+00:00
demux: heif: check the grid offset for overflow

Fixes #29935

- - - - -


1 changed file:

- modules/demux/mp4/heif.c


Changes:

=====================================
modules/demux/mp4/heif.c
=====================================
@@ -612,14 +612,17 @@ static int LoadGridImage( demux_t *p_demux,
     const unsigned tileheight = p_picture->format.i_visible_height;
     const unsigned offsetpxw = (tile % gridcols) * tilewidth;
     const unsigned offsetpxh = (tile / gridcols) * tileheight;
-    if (i_buffer < offsetpxh * imagewidth * 4)
+    unsigned offset_len;
+    if (ckd_mul(&offset_len, offsetpxh, imagewidth) ||
+        ckd_mul(&offset_len, offset_len, 4) ||
+        i_buffer < offset_len)
     {
         picture_Release( p_picture );
         return VLC_EINVAL;
     }
 
-    size_t dst_size = i_buffer - offsetpxh * imagewidth * 4;
-    uint8_t *dstline = &p_buffer[offsetpxh * imagewidth * 4];
+    size_t dst_size = i_buffer - offset_len;
+    uint8_t *dstline = &p_buffer[offset_len];
     if( offsetpxw <= imagewidth )
     {
         const uint8_t *srcline = p_picture->p[0].p_pixels +



View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/8a47770f6333df6b60181329db5fdaad318bdb44

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/8a47770f6333df6b60181329db5fdaad318bdb44
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help