Skip to content

validate rowBytes and width overflow in avifImageRGBToYUV#3146

Open
uwezkhan wants to merge 1 commit intoAOMediaCodec:mainfrom
uwezkhan:rowbytes-check
Open

validate rowBytes and width overflow in avifImageRGBToYUV#3146
uwezkhan wants to merge 1 commit intoAOMediaCodec:mainfrom
uwezkhan:rowbytes-check

Conversation

@uwezkhan
Copy link
Copy Markdown
Contributor

Added validation in avifImageRGBToYUV to make sure rowBytes and width are safe before processing.

What was the issue

The function was using rowBytes directly without checking if it was actually large enough for the given width and pixel size.
If rowBytes is smaller than expected, it can read past the buffer.
Also, width * pixelSize could overflow in some cases.

What I changed

  • Added a check to prevent overflow in width * pixelSize
  • Added a check to ensure rowBytes is not smaller than required

Impact

This prevents out-of-bounds reads when invalid RGB input is passed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant