From 5aedf31b464585a8f7148d79b89f54948c3d6f66 Mon Sep 17 00:00:00 2001 From: Rangi Date: Tue, 7 Jul 2026 16:57:13 -0400 Subject: [PATCH] Prevent 32-bit multiplication overflow Basically impossible to achieve, but just in case --- src/gfx/png.cpp | 5 +++-- src/gfx/process.cpp | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/src/gfx/png.cpp b/src/gfx/png.cpp index b9b8e815..a48c3c28 100644 --- a/src/gfx/png.cpp +++ b/src/gfx/png.cpp @@ -100,7 +100,8 @@ Png::Png(char const *filename, std::streambuf &file) { png, info, &width, &height, &bitDepth, &colorType, &interlaceType, nullptr, nullptr ); - pixels.resize(static_cast(width) * static_cast(height)); + size_t nbPixels = static_cast(width) * static_cast(height); + pixels.resize(nbPixels); auto colorTypeName = [](int type) { switch (type) { @@ -212,7 +213,7 @@ Png::Png(char const *filename, std::streambuf &file) { assume(png_get_bit_depth(png, info) == 8); // Now that metadata has been read, we can read the image data - std::vector image(width * height * 4); + std::vector image(nbPixels * 4); std::vector rowPtrs(height); for (uint32_t y = 0; y < height; ++y) { rowPtrs[y] = image.data() + y * width * 4; diff --git a/src/gfx/process.cpp b/src/gfx/process.cpp index 6af0203e..82ac0778 100644 --- a/src/gfx/process.cpp +++ b/src/gfx/process.cpp @@ -1146,10 +1146,10 @@ continue_visiting_tiles:; uint32_t const nbTilesH = image.png.height / 8, nbTilesW = image.png.width / 8; // Check the tile count - if (uint32_t nbTiles = nbTilesW * nbTilesH; + if (uint64_t nbTiles = nbTilesW * nbTilesH; nbTiles > options.maxNbTiles[0] + options.maxNbTiles[1]) { fatal( - "Image contains %" PRIu32 " tiles, exceeding the limit of %" PRIu16 " + %" PRIu16, + "Image contains %" PRIu64 " tiles, exceeding the limit of %" PRIu16 " + %" PRIu16, nbTiles, options.maxNbTiles[0], options.maxNbTiles[1]