Fix unsigned integer multiplication overflow on i386 build (#3695)

(cherry picked from commit 060080285a4fe81c9cb3a01381bbbd907c5dfea5)
google · Dec 5, 2024 · 0e1976e · 0e1976e
1 parent dc31aeb
commit 0e1976e
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/lib/extras/image.cc b/lib/extras/image.cc
@@ -9,6 +9,7 @@
 #include <algorithm>  // fill, swap
 #include <cstddef>
 #include <cstdint>
+#include <limits>
 
 #include "lib/base/memory_manager.h"
 #include "lib/base/status.h"
@@ -80,6 +81,11 @@ Status PlaneBase::Allocate(JxlMemoryManager* memory_manager,
     return true;
   }
 
+  size_t max_y_size = std::numeric_limits<size_t>::max() / bytes_per_row_;
+  if (ysize_ > max_y_size) {
+    return JXL_FAILURE("Image dimensions are too large");
+  }
+
   JXL_ASSIGN_OR_RETURN(
       bytes_, AlignedMemory::Create(memory_manager, bytes_per_row_ * ysize_,
                                     pre_padding * sizeof_t_));