Allow any value for avifDecoder::imageSizeLimit All known integer overflows in libavif's decoder code, excluding external dependencies, have been fixed.
diff --git a/CHANGELOG.md b/CHANGELOG.md index 0ba9e94..510cc2d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md
@@ -24,6 +24,7 @@ * Fix printed image size in avifgainmaputil when using --grid. * Fix printed gain map size in avifenc when converting a jpeg with a gain map and using --grid. +* Allow setting avifDecoder::imageSizeLimit to any value. ## [1.4.2] - 2026-05-26
diff --git a/apps/avifdec.c b/apps/avifdec.c index 08cff7b..a9d23ae 100644 --- a/apps/avifdec.c +++ b/apps/avifdec.c
@@ -47,10 +47,10 @@ printf(" -i,--info : Decode all frames and display all image information instead of saving to disk\n"); printf(" --icc FILENAME : Provide an ICC profile payload (implies --ignore-icc)\n"); printf(" --ignore-icc : If the input file contains an embedded ICC profile, ignore it (no-op if absent)\n"); - printf(" --size-limit C : Maximum image size (in total pixels) that should be tolerated. (Default: %u)\n", - AVIF_DEFAULT_IMAGE_SIZE_LIMIT); + printf(" --size-limit C : Maximum image size (in total pixels) that should be tolerated.\n"); + printf(" 0 means unlimited. (Default: %u)\n", AVIF_DEFAULT_IMAGE_SIZE_LIMIT); printf(" --dimension-limit C : Maximum image dimension (width or height) that should be tolerated.\n"); - printf(" Set to 0 to ignore. (Default: %u)\n", AVIF_DEFAULT_IMAGE_DIMENSION_LIMIT); + printf(" 0 means unlimited. (Default: %u)\n", AVIF_DEFAULT_IMAGE_DIMENSION_LIMIT); printf(" -- : Signal the end of options. Everything after this is interpreted as file names.\n"); printf("\n"); avifPrintVersions(); @@ -229,7 +229,7 @@ } else if (!strcmp(arg, "--size-limit")) { NEXTARG(); unsigned long value = strtoul(arg, NULL, 10); - if ((value > AVIF_DEFAULT_IMAGE_SIZE_LIMIT) || (value == 0)) { + if (value > UINT32_MAX) { fprintf(stderr, "ERROR: invalid image size limit: %s\n", arg); return 1; }
diff --git a/doc/avifdec.1.md b/doc/avifdec.1.md index d0c2eb6..e4c4f54 100644 --- a/doc/avifdec.1.md +++ b/doc/avifdec.1.md
@@ -83,11 +83,11 @@ **\--size-limit** _C_ : Maximum image size (in total pixels) that should be tolerated. - (Default: 268435456). + 0 means unlimited. (Default: 268435456). **\--dimension-limit** _C_ : Maximum image dimension (width or height) that should be tolerated. - Set to 0 to ignore. (Default: 32768). + 0 means unlimited. (Default: 32768). **\--** : Signal the end of options. Everything after this is interpreted as file names.
diff --git a/include/avif/avif.h b/include/avif/avif.h index 44ca021..27baf2f 100644 --- a/include/avif/avif.h +++ b/include/avif/avif.h
@@ -1290,14 +1290,14 @@ avifBool ignoreXMP; // This represents the maximum size of an image (in pixel count) that libavif and the underlying - // AV1 decoder should attempt to decode. It defaults to AVIF_DEFAULT_IMAGE_SIZE_LIMIT, and can - // be set to a smaller value. The value 0 is reserved. - // Note: Only some underlying AV1 codecs support a configurable size limit (such as dav1d). + // AV1 decoder should attempt to decode. It defaults to AVIF_DEFAULT_IMAGE_SIZE_LIMIT. 0 means + // unlimited. + // Note: Only some underlying AV1 codecs support a configurable size limit (such as dav1d and + // libaom v3.14.0 or later). uint32_t imageSizeLimit; // This represents the maximum dimension of an image (width or height) that libavif should - // attempt to decode. It defaults to AVIF_DEFAULT_IMAGE_DIMENSION_LIMIT. Set it to 0 to ignore - // the limit. + // attempt to decode. It defaults to AVIF_DEFAULT_IMAGE_DIMENSION_LIMIT. 0 means unlimited. uint32_t imageDimensionLimit; // This provides an upper bound on how many images the decoder is willing to attempt to decode,
diff --git a/src/avif.c b/src/avif.c index 76185db..20075e7 100644 --- a/src/avif.c +++ b/src/avif.c
@@ -645,7 +645,7 @@ avifBool avifDimensionsTooLarge(uint32_t width, uint32_t height, uint32_t imageSizeLimit, uint32_t imageDimensionLimit) { - if (width > (imageSizeLimit / height)) { + if ((imageSizeLimit != 0) && (width > (imageSizeLimit / height))) { return AVIF_TRUE; } if ((imageDimensionLimit != 0) && ((width > imageDimensionLimit) || (height > imageDimensionLimit))) {
diff --git a/src/read.c b/src/read.c index 2bc7696..f9340f2 100644 --- a/src/read.c +++ b/src/read.c
@@ -5289,11 +5289,6 @@ { avifDiagnosticsClearError(&decoder->diag); - // An imageSizeLimit greater than AVIF_DEFAULT_IMAGE_SIZE_LIMIT and the special value of 0 to - // disable the limit are not yet implemented. - if ((decoder->imageSizeLimit > AVIF_DEFAULT_IMAGE_SIZE_LIMIT) || (decoder->imageSizeLimit == 0)) { - return AVIF_RESULT_NOT_IMPLEMENTED; - } // Color only or alpha only is not currently supported. if ((decoder->imageContentToDecode & AVIF_IMAGE_CONTENT_COLOR_AND_ALPHA) != 0 && (decoder->imageContentToDecode & AVIF_IMAGE_CONTENT_COLOR_AND_ALPHA) != AVIF_IMAGE_CONTENT_COLOR_AND_ALPHA) {
diff --git a/tests/gtest/avif_fuzztest_dec_incr.cc b/tests/gtest/avif_fuzztest_dec_incr.cc index fc3bc2f..24654f7 100644 --- a/tests/gtest/avif_fuzztest_dec_incr.cc +++ b/tests/gtest/avif_fuzztest_dec_incr.cc
@@ -75,10 +75,6 @@ // Reduce the limit further to include pixel buffer copies and other memory // allocations. constexpr uint32_t kImageSizeLimit = kMaxImageSize / 4; - // avifDecoderParse returns AVIF_RESULT_NOT_IMPLEMENTED if kImageSizeLimit is - // bigger than AVIF_DEFAULT_IMAGE_SIZE_LIMIT. - static_assert(kImageSizeLimit <= AVIF_DEFAULT_IMAGE_SIZE_LIMIT, - "Too big an image size limit"); decoder->imageSizeLimit = kImageSizeLimit; // This can lead to AVIF_RESULT_NO_CONTENT. decoder->imageContentToDecode = content_to_decode;