Skip to content

fix: prevent uint32_t overflow in avifSetTileConfiguration tile area #3052

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
wantehchang merged 2 commits into from
Feb 26, 2026
Merged

fix: prevent uint32_t overflow in avifSetTileConfiguration tile area #3052

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f428b94
fix: prevent uint32_t overflow in avifSetTileConfiguration tile area
uwezkhan Feb 21, 2026
360c249
feat: implement AVIF encoder's file writing logic, including item, fr…
uwezkhan Feb 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions src/write.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,8 +98,10 @@ void avifSetTileConfiguration(int threads, uint32_t width, uint32_t height, int
// number of threads would result in a compression penalty without much benefit.
const uint32_t kMinTileArea = 512 * 512;
const uint32_t kMaxTiles = 32;
uint32_t imageArea = width * height;
uint32_t tiles = (imageArea + kMinTileArea - 1) / kMinTileArea;
// AV1 requires width <= 65536 and height <= 65536, so their product fits
// in uint64_t and the resulting tile count fits in uint32_t.
Copy link
Copy Markdown
Collaborator

@wantehchang wantehchang Feb 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I merged PR #3061, so the caller now validates width <= 65536 and height <= 65536.

Note: For the purpose of this function, we could also clamp width and height to 65536 within this function. Then we don't need the caller to validate that.

const uint64_t imageArea = (uint64_t)width * height;
uint32_t tiles = (uint32_t)((imageArea + kMinTileArea - 1) / kMinTileArea);
if (tiles > kMaxTiles) {
tiles = kMaxTiles;
}
Expand Down
Loading