Fix potential integer overflow in rowBytes multiplications
Cast the first operand to (size_t) before multiplying two uint32_t
values involving rowBytes, alphaRowBytes, or yuvRowBytes to prevent
unsigned integer wrap-around on large images.
diff --git a/src/codec_aom.c b/src/codec_aom.c
index 8947edf..bcdabc7 100644
--- a/src/codec_aom.c
+++ b/src/codec_aom.c
@@ -1217,8 +1217,8 @@
if (aomImageAllocated) {
const uint32_t bytesPerRow = ((image->depth > 8) ? 2 : 1) * image->width;
for (uint32_t j = 0; j < image->height; ++j) {
- const uint8_t * srcAlphaRow = &image->alphaPlane[j * image->alphaRowBytes];
- uint8_t * dstAlphaRow = &aomImage.planes[0][j * aomImage.stride[0]];
+ const uint8_t * srcAlphaRow = &image->alphaPlane[(size_t)j * image->alphaRowBytes];
+ uint8_t * dstAlphaRow = &aomImage.planes[0][(size_t)j * aomImage.stride[0]];
memcpy(dstAlphaRow, srcAlphaRow, bytesPerRow);
}
} else {
@@ -1241,8 +1241,8 @@
uint32_t bytesPerRow = bytesPerPixel * planeWidth;
for (uint32_t j = 0; j < planeHeight; ++j) {
- const uint8_t * srcRow = &image->yuvPlanes[yuvPlane][j * image->yuvRowBytes[yuvPlane]];
- uint8_t * dstRow = &aomImage.planes[yuvPlane][j * aomImage.stride[yuvPlane]];
+ const uint8_t * srcRow = &image->yuvPlanes[yuvPlane][(size_t)j * image->yuvRowBytes[yuvPlane]];
+ uint8_t * dstRow = &aomImage.planes[yuvPlane][(size_t)j * aomImage.stride[yuvPlane]];
memcpy(dstRow, srcRow, bytesPerRow);
}
}
diff --git a/src/codec_avm.c b/src/codec_avm.c
index e162772..c016eeb 100644
--- a/src/codec_avm.c
+++ b/src/codec_avm.c
@@ -903,8 +903,8 @@
if (avmImageAllocated) {
const uint32_t bytesPerRow = ((image->depth > 8) ? 2 : 1) * image->width;
for (uint32_t j = 0; j < image->height; ++j) {
- const uint8_t * srcAlphaRow = &image->alphaPlane[j * image->alphaRowBytes];
- uint8_t * dstAlphaRow = &avmImage.planes[0][j * avmImage.stride[0]];
+ const uint8_t * srcAlphaRow = &image->alphaPlane[(size_t)j * image->alphaRowBytes];
+ uint8_t * dstAlphaRow = &avmImage.planes[0][(size_t)j * avmImage.stride[0]];
memcpy(dstAlphaRow, srcAlphaRow, bytesPerRow);
}
} else {
@@ -927,8 +927,8 @@
uint32_t bytesPerRow = bytesPerPixel * planeWidth;
for (uint32_t j = 0; j < planeHeight; ++j) {
- const uint8_t * srcRow = &image->yuvPlanes[yuvPlane][j * image->yuvRowBytes[yuvPlane]];
- uint8_t * dstRow = &avmImage.planes[yuvPlane][j * avmImage.stride[yuvPlane]];
+ const uint8_t * srcRow = &image->yuvPlanes[yuvPlane][(size_t)j * image->yuvRowBytes[yuvPlane]];
+ uint8_t * dstRow = &avmImage.planes[yuvPlane][(size_t)j * avmImage.stride[yuvPlane]];
memcpy(dstRow, srcRow, bytesPerRow);
}
}
diff --git a/src/codec_svt.c b/src/codec_svt.c
index e893e46..2b887e8 100644
--- a/src/codec_svt.c
+++ b/src/codec_svt.c
@@ -274,22 +274,32 @@
if (alpha) {
input_picture_buffer->y_stride = image->alphaRowBytes / bytesPerPixel;
input_picture_buffer->luma = image->alphaPlane;
- input_buffer->n_filled_len = image->alphaRowBytes * image->height;
+ const size_t alphaSize = (size_t)image->alphaRowBytes * image->height;
+ if (alphaSize > UINT32_MAX) {
+ goto cleanup;
+ }
+ input_buffer->n_filled_len = (uint32_t)alphaSize;
#if SVT_AV1_CHECK_VERSION(1, 8, 0)
// Simulate 4:2:0 UV planes. SVT-AV1 does not support 4:0:0 samples.
const uint32_t uvWidth = (image->width + y_shift) >> y_shift;
const uint32_t uvRowBytes = uvWidth * bytesPerPixel;
- const uint32_t uvSize = uvRowBytes * uvHeight;
+ const size_t uvSize = (size_t)uvRowBytes * uvHeight;
+ if (uvSize > UINT32_MAX / 2) {
+ goto cleanup;
+ }
+ if (uvSize * 2 > UINT32_MAX - input_buffer->n_filled_len) {
+ goto cleanup;
+ }
uvPlanes = avifAlloc(uvSize);
if (uvPlanes == NULL) {
goto cleanup;
}
memset(uvPlanes, 0, uvSize);
input_picture_buffer->cb = uvPlanes;
- input_buffer->n_filled_len += uvSize;
+ input_buffer->n_filled_len += (uint32_t)uvSize;
input_picture_buffer->cr = uvPlanes;
- input_buffer->n_filled_len += uvSize;
+ input_buffer->n_filled_len += (uint32_t)uvSize;
input_picture_buffer->cb_stride = uvWidth;
input_picture_buffer->cr_stride = uvWidth;
#else
@@ -300,11 +310,23 @@
} else {
input_picture_buffer->y_stride = image->yuvRowBytes[0] / bytesPerPixel;
input_picture_buffer->luma = image->yuvPlanes[0];
- input_buffer->n_filled_len = image->yuvRowBytes[0] * image->height;
+ const size_t ySize = (size_t)image->yuvRowBytes[0] * image->height;
+ if (ySize > UINT32_MAX) {
+ goto cleanup;
+ }
+ input_buffer->n_filled_len = (uint32_t)ySize;
input_picture_buffer->cb = image->yuvPlanes[1];
- input_buffer->n_filled_len += image->yuvRowBytes[1] * uvHeight;
+ const size_t uSize = (size_t)image->yuvRowBytes[1] * uvHeight;
+ if (uSize > UINT32_MAX - input_buffer->n_filled_len) {
+ goto cleanup;
+ }
+ input_buffer->n_filled_len += (uint32_t)uSize;
input_picture_buffer->cr = image->yuvPlanes[2];
- input_buffer->n_filled_len += image->yuvRowBytes[2] * uvHeight;
+ const size_t vSize = (size_t)image->yuvRowBytes[2] * uvHeight;
+ if (vSize > UINT32_MAX - input_buffer->n_filled_len) {
+ goto cleanup;
+ }
+ input_buffer->n_filled_len += (uint32_t)vSize;
input_picture_buffer->cb_stride = image->yuvRowBytes[1] / bytesPerPixel;
input_picture_buffer->cr_stride = image->yuvRowBytes[2] / bytesPerPixel;
}
diff --git a/src/read.c b/src/read.c
index a5512d0..e65eb66 100644
--- a/src/read.c
+++ b/src/read.c
@@ -6599,8 +6599,8 @@
if (image->depth > 8) {
for (uint32_t j = 0; j < image->height; ++j) {
- const uint8_t * srcRow = &alphaPlane[j * alphaRowBytes];
- uint8_t * dstRow = &image->alphaPlane[j * image->alphaRowBytes];
+ const uint8_t * srcRow = &alphaPlane[(size_t)j * alphaRowBytes];
+ uint8_t * dstRow = &image->alphaPlane[(size_t)j * image->alphaRowBytes];
for (uint32_t i = 0; i < image->width; ++i) {
int srcAlpha = *((const uint16_t *)&srcRow[i * 2]);
int dstAlpha = avifLimitedToFullY(image->depth, srcAlpha);
@@ -6609,8 +6609,8 @@
}
} else {
for (uint32_t j = 0; j < image->height; ++j) {
- const uint8_t * srcRow = &alphaPlane[j * alphaRowBytes];
- uint8_t * dstRow = &image->alphaPlane[j * image->alphaRowBytes];
+ const uint8_t * srcRow = &alphaPlane[(size_t)j * alphaRowBytes];
+ uint8_t * dstRow = &image->alphaPlane[(size_t)j * image->alphaRowBytes];
for (uint32_t i = 0; i < image->width; ++i) {
int srcAlpha = srcRow[i];
int dstAlpha = avifLimitedToFullY(image->depth, srcAlpha);
diff --git a/src/reformat.c b/src/reformat.c
index 9d4260b..7b53add 100644
--- a/src/reformat.c
+++ b/src/reformat.c
@@ -469,10 +469,10 @@
const uint32_t grayPixelBytes = state.rgb.pixelBytes;
const uint32_t offsetBytesGray = state.rgb.offsetBytesGray;
const uint32_t offsetBytesA = state.rgb.offsetBytesA;
- const uint32_t grayRowBytes = rgb->rowBytes;
+ const size_t grayRowBytes = rgb->rowBytes;
const float grayMaxChannelF = state.rgb.maxChannelF;
uint8_t * yPlane = image->yuvPlanes[AVIF_CHAN_Y];
- const uint32_t yRowBytes = image->yuvRowBytes[AVIF_CHAN_Y];
+ const size_t yRowBytes = image->yuvRowBytes[AVIF_CHAN_Y];
for (uint32_t j = 0; j < image->height; ++j) {
for (uint32_t i = 0; i < image->width; ++i) {
float g;
@@ -521,7 +521,7 @@
const int half = 1 << (image->depth - 1);
if (image->yuvPlanes[AVIF_CHAN_U]) {
uint8_t * uPlane = image->yuvPlanes[AVIF_CHAN_U];
- const uint32_t uRowBytes = image->yuvRowBytes[AVIF_CHAN_U];
+ const size_t uRowBytes = image->yuvRowBytes[AVIF_CHAN_U];
if (state.yuv.channelBytes > 1) {
avifMemset16(uPlane, half, shiftedH * uRowBytes / 2);
} else {
@@ -530,7 +530,7 @@
}
if (image->yuvPlanes[AVIF_CHAN_V]) {
uint8_t * vPlane = image->yuvPlanes[AVIF_CHAN_V];
- const uint32_t vRowBytes = image->yuvRowBytes[AVIF_CHAN_V];
+ const size_t vRowBytes = image->yuvRowBytes[AVIF_CHAN_V];
if (state.yuv.channelBytes > 1) {
avifMemset16(vPlane, half, shiftedH * vRowBytes / 2);
} else {
@@ -692,10 +692,10 @@
const uint16_t * ptrV16 = (const uint16_t *)ptrV8;
const uint16_t * ptrA16 = (const uint16_t *)ptrA8;
- uint8_t * ptrR = &rgb->pixels[state->rgb.offsetBytesR + (j * rgb->rowBytes)];
- uint8_t * ptrG = &rgb->pixels[state->rgb.offsetBytesG + (j * rgb->rowBytes)];
- uint8_t * ptrB = &rgb->pixels[state->rgb.offsetBytesB + (j * rgb->rowBytes)];
- uint8_t * ptrGray = &rgb->pixels[state->rgb.offsetBytesGray + (j * rgb->rowBytes)];
+ uint8_t * ptrR = &rgb->pixels[state->rgb.offsetBytesR + ((size_t)j * rgb->rowBytes)];
+ uint8_t * ptrG = &rgb->pixels[state->rgb.offsetBytesG + ((size_t)j * rgb->rowBytes)];
+ uint8_t * ptrB = &rgb->pixels[state->rgb.offsetBytesB + ((size_t)j * rgb->rowBytes)];
+ uint8_t * ptrGray = &rgb->pixels[state->rgb.offsetBytesGray + ((size_t)j * rgb->rowBytes)];
for (uint32_t i = 0; i < image->width; ++i) {
float Y, Cb = 0.5f, Cr = 0.5f;
@@ -986,12 +986,12 @@
const float rgbMaxChannelF = state->rgb.maxChannelF;
for (uint32_t j = 0; j < image->height; ++j) {
const uint32_t uvJ = j >> state->yuv.formatInfo.chromaShiftY;
- const uint16_t * const ptrY = (uint16_t *)&image->yuvPlanes[AVIF_CHAN_Y][(j * image->yuvRowBytes[AVIF_CHAN_Y])];
- const uint16_t * const ptrU = (uint16_t *)&image->yuvPlanes[AVIF_CHAN_U][(uvJ * image->yuvRowBytes[AVIF_CHAN_U])];
- const uint16_t * const ptrV = (uint16_t *)&image->yuvPlanes[AVIF_CHAN_V][(uvJ * image->yuvRowBytes[AVIF_CHAN_V])];
- uint8_t * ptrR = &rgb->pixels[state->rgb.offsetBytesR + (j * rgb->rowBytes)];
- uint8_t * ptrG = &rgb->pixels[state->rgb.offsetBytesG + (j * rgb->rowBytes)];
- uint8_t * ptrB = &rgb->pixels[state->rgb.offsetBytesB + (j * rgb->rowBytes)];
+ const uint16_t * const ptrY = (uint16_t *)&image->yuvPlanes[AVIF_CHAN_Y][((size_t)j * image->yuvRowBytes[AVIF_CHAN_Y])];
+ const uint16_t * const ptrU = (uint16_t *)&image->yuvPlanes[AVIF_CHAN_U][((size_t)uvJ * image->yuvRowBytes[AVIF_CHAN_U])];
+ const uint16_t * const ptrV = (uint16_t *)&image->yuvPlanes[AVIF_CHAN_V][((size_t)uvJ * image->yuvRowBytes[AVIF_CHAN_V])];
+ uint8_t * ptrR = &rgb->pixels[state->rgb.offsetBytesR + ((size_t)j * rgb->rowBytes)];
+ uint8_t * ptrG = &rgb->pixels[state->rgb.offsetBytesG + ((size_t)j * rgb->rowBytes)];
+ uint8_t * ptrB = &rgb->pixels[state->rgb.offsetBytesB + ((size_t)j * rgb->rowBytes)];
for (uint32_t i = 0; i < image->width; ++i) {
uint32_t uvI = i >> state->yuv.formatInfo.chromaShiftX;
@@ -1038,10 +1038,10 @@
const uint16_t maxChannel = (uint16_t)state->yuv.maxChannel;
const float maxChannelF = state->rgb.maxChannelF;
for (uint32_t j = 0; j < image->height; ++j) {
- const uint16_t * const ptrY = (uint16_t *)&image->yuvPlanes[AVIF_CHAN_Y][(j * image->yuvRowBytes[AVIF_CHAN_Y])];
- uint8_t * ptrR = &rgb->pixels[state->rgb.offsetBytesR + (j * rgb->rowBytes)];
- uint8_t * ptrG = &rgb->pixels[state->rgb.offsetBytesG + (j * rgb->rowBytes)];
- uint8_t * ptrB = &rgb->pixels[state->rgb.offsetBytesB + (j * rgb->rowBytes)];
+ const uint16_t * const ptrY = (uint16_t *)&image->yuvPlanes[AVIF_CHAN_Y][((size_t)j * image->yuvRowBytes[AVIF_CHAN_Y])];
+ uint8_t * ptrR = &rgb->pixels[state->rgb.offsetBytesR + ((size_t)j * rgb->rowBytes)];
+ uint8_t * ptrG = &rgb->pixels[state->rgb.offsetBytesG + ((size_t)j * rgb->rowBytes)];
+ uint8_t * ptrB = &rgb->pixels[state->rgb.offsetBytesB + ((size_t)j * rgb->rowBytes)];
for (uint32_t i = 0; i < image->width; ++i) {
// clamp incoming data to protect against bad LUT lookups
@@ -1086,12 +1086,12 @@
const float rgbMaxChannelF = state->rgb.maxChannelF;
for (uint32_t j = 0; j < image->height; ++j) {
const uint32_t uvJ = j >> state->yuv.formatInfo.chromaShiftY;
- const uint16_t * const ptrY = (uint16_t *)&image->yuvPlanes[AVIF_CHAN_Y][(j * image->yuvRowBytes[AVIF_CHAN_Y])];
- const uint16_t * const ptrU = (uint16_t *)&image->yuvPlanes[AVIF_CHAN_U][(uvJ * image->yuvRowBytes[AVIF_CHAN_U])];
- const uint16_t * const ptrV = (uint16_t *)&image->yuvPlanes[AVIF_CHAN_V][(uvJ * image->yuvRowBytes[AVIF_CHAN_V])];
- uint8_t * ptrR = &rgb->pixels[state->rgb.offsetBytesR + (j * rgb->rowBytes)];
- uint8_t * ptrG = &rgb->pixels[state->rgb.offsetBytesG + (j * rgb->rowBytes)];
- uint8_t * ptrB = &rgb->pixels[state->rgb.offsetBytesB + (j * rgb->rowBytes)];
+ const uint16_t * const ptrY = (uint16_t *)&image->yuvPlanes[AVIF_CHAN_Y][((size_t)j * image->yuvRowBytes[AVIF_CHAN_Y])];
+ const uint16_t * const ptrU = (uint16_t *)&image->yuvPlanes[AVIF_CHAN_U][((size_t)uvJ * image->yuvRowBytes[AVIF_CHAN_U])];
+ const uint16_t * const ptrV = (uint16_t *)&image->yuvPlanes[AVIF_CHAN_V][((size_t)uvJ * image->yuvRowBytes[AVIF_CHAN_V])];
+ uint8_t * ptrR = &rgb->pixels[state->rgb.offsetBytesR + ((size_t)j * rgb->rowBytes)];
+ uint8_t * ptrG = &rgb->pixels[state->rgb.offsetBytesG + ((size_t)j * rgb->rowBytes)];
+ uint8_t * ptrB = &rgb->pixels[state->rgb.offsetBytesB + ((size_t)j * rgb->rowBytes)];
for (uint32_t i = 0; i < image->width; ++i) {
uint32_t uvI = i >> state->yuv.formatInfo.chromaShiftX;
@@ -1142,10 +1142,10 @@
const uint16_t yuvMaxChannel = (uint16_t)state->yuv.maxChannel;
const float rgbMaxChannelF = state->rgb.maxChannelF;
for (uint32_t j = 0; j < image->height; ++j) {
- const uint16_t * const ptrY = (uint16_t *)&image->yuvPlanes[AVIF_CHAN_Y][(j * image->yuvRowBytes[AVIF_CHAN_Y])];
- uint8_t * ptrR = &rgb->pixels[state->rgb.offsetBytesR + (j * rgb->rowBytes)];
- uint8_t * ptrG = &rgb->pixels[state->rgb.offsetBytesG + (j * rgb->rowBytes)];
- uint8_t * ptrB = &rgb->pixels[state->rgb.offsetBytesB + (j * rgb->rowBytes)];
+ const uint16_t * const ptrY = (uint16_t *)&image->yuvPlanes[AVIF_CHAN_Y][((size_t)j * image->yuvRowBytes[AVIF_CHAN_Y])];
+ uint8_t * ptrR = &rgb->pixels[state->rgb.offsetBytesR + ((size_t)j * rgb->rowBytes)];
+ uint8_t * ptrG = &rgb->pixels[state->rgb.offsetBytesG + ((size_t)j * rgb->rowBytes)];
+ uint8_t * ptrB = &rgb->pixels[state->rgb.offsetBytesB + ((size_t)j * rgb->rowBytes)];
for (uint32_t i = 0; i < image->width; ++i) {
// clamp incoming data to protect against bad LUT lookups
@@ -1193,12 +1193,12 @@
const float rgbMaxChannelF = state->rgb.maxChannelF;
for (uint32_t j = 0; j < image->height; ++j) {
const uint32_t uvJ = j >> state->yuv.formatInfo.chromaShiftY;
- const uint8_t * const ptrY = &image->yuvPlanes[AVIF_CHAN_Y][(j * image->yuvRowBytes[AVIF_CHAN_Y])];
- const uint8_t * const ptrU = &image->yuvPlanes[AVIF_CHAN_U][(uvJ * image->yuvRowBytes[AVIF_CHAN_U])];
- const uint8_t * const ptrV = &image->yuvPlanes[AVIF_CHAN_V][(uvJ * image->yuvRowBytes[AVIF_CHAN_V])];
- uint8_t * ptrR = &rgb->pixels[state->rgb.offsetBytesR + (j * rgb->rowBytes)];
- uint8_t * ptrG = &rgb->pixels[state->rgb.offsetBytesG + (j * rgb->rowBytes)];
- uint8_t * ptrB = &rgb->pixels[state->rgb.offsetBytesB + (j * rgb->rowBytes)];
+ const uint8_t * const ptrY = &image->yuvPlanes[AVIF_CHAN_Y][((size_t)j * image->yuvRowBytes[AVIF_CHAN_Y])];
+ const uint8_t * const ptrU = &image->yuvPlanes[AVIF_CHAN_U][((size_t)uvJ * image->yuvRowBytes[AVIF_CHAN_U])];
+ const uint8_t * const ptrV = &image->yuvPlanes[AVIF_CHAN_V][((size_t)uvJ * image->yuvRowBytes[AVIF_CHAN_V])];
+ uint8_t * ptrR = &rgb->pixels[state->rgb.offsetBytesR + ((size_t)j * rgb->rowBytes)];
+ uint8_t * ptrG = &rgb->pixels[state->rgb.offsetBytesG + ((size_t)j * rgb->rowBytes)];
+ uint8_t * ptrB = &rgb->pixels[state->rgb.offsetBytesB + ((size_t)j * rgb->rowBytes)];
for (uint32_t i = 0; i < image->width; ++i) {
uint32_t uvI = i >> state->yuv.formatInfo.chromaShiftX;
@@ -1239,10 +1239,10 @@
const float rgbMaxChannelF = state->rgb.maxChannelF;
for (uint32_t j = 0; j < image->height; ++j) {
- const uint8_t * const ptrY = &image->yuvPlanes[AVIF_CHAN_Y][(j * image->yuvRowBytes[AVIF_CHAN_Y])];
- uint8_t * ptrR = &rgb->pixels[state->rgb.offsetBytesR + (j * rgb->rowBytes)];
- uint8_t * ptrG = &rgb->pixels[state->rgb.offsetBytesG + (j * rgb->rowBytes)];
- uint8_t * ptrB = &rgb->pixels[state->rgb.offsetBytesB + (j * rgb->rowBytes)];
+ const uint8_t * const ptrY = &image->yuvPlanes[AVIF_CHAN_Y][((size_t)j * image->yuvRowBytes[AVIF_CHAN_Y])];
+ uint8_t * ptrR = &rgb->pixels[state->rgb.offsetBytesR + ((size_t)j * rgb->rowBytes)];
+ uint8_t * ptrG = &rgb->pixels[state->rgb.offsetBytesG + ((size_t)j * rgb->rowBytes)];
+ uint8_t * ptrB = &rgb->pixels[state->rgb.offsetBytesB + ((size_t)j * rgb->rowBytes)];
for (uint32_t i = 0; i < image->width; ++i) {
// Convert unorm to float (no clamp necessary, the full uint8_t range is a legal lookup)
@@ -1274,12 +1274,12 @@
{
const uint32_t rgbPixelBytes = state->rgb.pixelBytes;
for (uint32_t j = 0; j < image->height; ++j) {
- const uint8_t * const ptrY = &image->yuvPlanes[AVIF_CHAN_Y][(j * image->yuvRowBytes[AVIF_CHAN_Y])];
- const uint8_t * const ptrU = &image->yuvPlanes[AVIF_CHAN_U][(j * image->yuvRowBytes[AVIF_CHAN_U])];
- const uint8_t * const ptrV = &image->yuvPlanes[AVIF_CHAN_V][(j * image->yuvRowBytes[AVIF_CHAN_V])];
- uint8_t * ptrR = &rgb->pixels[state->rgb.offsetBytesR + (j * rgb->rowBytes)];
- uint8_t * ptrG = &rgb->pixels[state->rgb.offsetBytesG + (j * rgb->rowBytes)];
- uint8_t * ptrB = &rgb->pixels[state->rgb.offsetBytesB + (j * rgb->rowBytes)];
+ const uint8_t * const ptrY = &image->yuvPlanes[AVIF_CHAN_Y][((size_t)j * image->yuvRowBytes[AVIF_CHAN_Y])];
+ const uint8_t * const ptrU = &image->yuvPlanes[AVIF_CHAN_U][((size_t)j * image->yuvRowBytes[AVIF_CHAN_U])];
+ const uint8_t * const ptrV = &image->yuvPlanes[AVIF_CHAN_V][((size_t)j * image->yuvRowBytes[AVIF_CHAN_V])];
+ uint8_t * ptrR = &rgb->pixels[state->rgb.offsetBytesR + ((size_t)j * rgb->rowBytes)];
+ uint8_t * ptrG = &rgb->pixels[state->rgb.offsetBytesG + ((size_t)j * rgb->rowBytes)];
+ uint8_t * ptrB = &rgb->pixels[state->rgb.offsetBytesB + ((size_t)j * rgb->rowBytes)];
// This is intentionally a per-row conditional instead of a per-pixel
// conditional. This makes the "else" path (much more common than the
@@ -1316,12 +1316,12 @@
const float rgbMaxChannelF = state->rgb.maxChannelF;
for (uint32_t j = 0; j < image->height; ++j) {
const uint32_t uvJ = j >> state->yuv.formatInfo.chromaShiftY;
- const uint8_t * const ptrY = &image->yuvPlanes[AVIF_CHAN_Y][(j * image->yuvRowBytes[AVIF_CHAN_Y])];
- const uint8_t * const ptrU = &image->yuvPlanes[AVIF_CHAN_U][(uvJ * image->yuvRowBytes[AVIF_CHAN_U])];
- const uint8_t * const ptrV = &image->yuvPlanes[AVIF_CHAN_V][(uvJ * image->yuvRowBytes[AVIF_CHAN_V])];
- uint8_t * ptrR = &rgb->pixels[state->rgb.offsetBytesR + (j * rgb->rowBytes)];
- uint8_t * ptrG = &rgb->pixels[state->rgb.offsetBytesG + (j * rgb->rowBytes)];
- uint8_t * ptrB = &rgb->pixels[state->rgb.offsetBytesB + (j * rgb->rowBytes)];
+ const uint8_t * const ptrY = &image->yuvPlanes[AVIF_CHAN_Y][((size_t)j * image->yuvRowBytes[AVIF_CHAN_Y])];
+ const uint8_t * const ptrU = &image->yuvPlanes[AVIF_CHAN_U][((size_t)uvJ * image->yuvRowBytes[AVIF_CHAN_U])];
+ const uint8_t * const ptrV = &image->yuvPlanes[AVIF_CHAN_V][((size_t)uvJ * image->yuvRowBytes[AVIF_CHAN_V])];
+ uint8_t * ptrR = &rgb->pixels[state->rgb.offsetBytesR + ((size_t)j * rgb->rowBytes)];
+ uint8_t * ptrG = &rgb->pixels[state->rgb.offsetBytesG + ((size_t)j * rgb->rowBytes)];
+ uint8_t * ptrB = &rgb->pixels[state->rgb.offsetBytesB + ((size_t)j * rgb->rowBytes)];
for (uint32_t i = 0; i < image->width; ++i) {
uint32_t uvI = i >> state->yuv.formatInfo.chromaShiftX;
@@ -1366,10 +1366,10 @@
const float rgbMaxChannelF = state->rgb.maxChannelF;
for (uint32_t j = 0; j < image->height; ++j) {
- const uint8_t * const ptrY = &image->yuvPlanes[AVIF_CHAN_Y][(j * image->yuvRowBytes[AVIF_CHAN_Y])];
- uint8_t * ptrR = &rgb->pixels[state->rgb.offsetBytesR + (j * rgb->rowBytes)];
- uint8_t * ptrG = &rgb->pixels[state->rgb.offsetBytesG + (j * rgb->rowBytes)];
- uint8_t * ptrB = &rgb->pixels[state->rgb.offsetBytesB + (j * rgb->rowBytes)];
+ const uint8_t * const ptrY = &image->yuvPlanes[AVIF_CHAN_Y][((size_t)j * image->yuvRowBytes[AVIF_CHAN_Y])];
+ uint8_t * ptrR = &rgb->pixels[state->rgb.offsetBytesR + ((size_t)j * rgb->rowBytes)];
+ uint8_t * ptrG = &rgb->pixels[state->rgb.offsetBytesG + ((size_t)j * rgb->rowBytes)];
+ uint8_t * ptrB = &rgb->pixels[state->rgb.offsetBytesB + ((size_t)j * rgb->rowBytes)];
for (uint32_t i = 0; i < image->width; ++i) {
// Convert unorm to float (no clamp necessary, the full uint8_t range is a legal lookup)
@@ -1854,7 +1854,7 @@
assert(!src->isFloat || src->depth == 16);
assert(src->format != AVIF_RGB_FORMAT_RGB_565 || src->depth == 8);
- const uint8_t * const srcPixel = &src->pixels[y * src->rowBytes + x * info->pixelBytes];
+ const uint8_t * const srcPixel = &src->pixels[(size_t)y * src->rowBytes + (size_t)x * info->pixelBytes];
if (info->channelBytes > 1) {
uint16_t r = *((const uint16_t *)(&srcPixel[info->offsetBytesR]));
uint16_t g = *((const uint16_t *)(&srcPixel[info->offsetBytesG]));
@@ -1897,7 +1897,7 @@
assert(rgbaPixel[1] >= 0.0f && rgbaPixel[1] <= 1.0f);
assert(rgbaPixel[2] >= 0.0f && rgbaPixel[2] <= 1.0f);
- uint8_t * const dstPixel = &dst->pixels[y * dst->rowBytes + x * info->pixelBytes];
+ uint8_t * const dstPixel = &dst->pixels[(size_t)y * dst->rowBytes + (size_t)x * info->pixelBytes];
uint8_t * const ptrR = &dstPixel[info->offsetBytesR];
uint8_t * const ptrG = &dstPixel[info->offsetBytesG];
