Disallow zero grid output_width or output_height (#265)
Fix https://crbug.com/oss-fuzz/24818 and
https://crbug.com/oss-fuzz/24821. These bugs were introduced by my fix
for https://crbug.com/oss-fuzz/24728 and
https://crbug.com/oss-fuzz/24734.
diff --git a/src/read.c b/src/read.c
index bb0d39f..2297a69 100644
--- a/src/read.c
+++ b/src/read.c
@@ -983,7 +983,7 @@
CHECK(avifROStreamReadU32(&s, &grid->outputWidth)); // unsigned int(FieldLength) output_width;
CHECK(avifROStreamReadU32(&s, &grid->outputHeight)); // unsigned int(FieldLength) output_height;
}
- if (grid->outputWidth > AVIF_MAX_IMAGE_SIZE / grid->outputHeight) {
+ if (grid->outputWidth == 0 || grid->outputHeight == 0 || grid->outputWidth > AVIF_MAX_IMAGE_SIZE / grid->outputHeight) {
return AVIF_FALSE;
}
return AVIF_TRUE;