Detect multiplication overflow in avifArrayCreate Detect whether (size_t)arr->elementSize * arr->capacity would overflow.
diff --git a/src/utils.c b/src/utils.c index 8578d30..a802963 100644 --- a/src/utils.c +++ b/src/utils.c
@@ -5,6 +5,7 @@ #include <assert.h> #include <math.h> +#include <stdint.h> #include <string.h> float avifRoundf(float v) @@ -89,6 +90,11 @@ arr->elementSize = elementSize ? elementSize : 1; arr->count = 0; arr->capacity = initialCapacity; + if (arr->capacity > SIZE_MAX / arr->elementSize) { + arr->ptr = NULL; + arr->capacity = 0; + return AVIF_FALSE; + } size_t byteCount = (size_t)arr->elementSize * arr->capacity; arr->ptr = (uint8_t *)avifAlloc(byteCount); if (!arr->ptr) {