@@ -40,25 +40,24 @@ static avifResult UpsampleYUV420To444(avifImage* image) {
4040 const uint32_t old_uv_height = (uint32_t )(((uint64_t )image->height + 1 ) / 2 );
4141 const uint32_t bytes_per_pixel = (image->depth > 8 ) ? 2 : 1 ;
4242
43- const uint64_t uv_byte_size =
44- (uint64_t )new_uv_width * new_uv_height * bytes_per_pixel;
45- if (uv_byte_size > SIZE_MAX ) {
43+ if (new_uv_width > UINT32_MAX / bytes_per_pixel) {
4644 return AVIF_RESULT_INVALID_ARGUMENT ;
4745 }
48- uint8_t * new_u = (uint8_t *)avifAlloc ((size_t )uv_byte_size);
49- uint8_t * new_v = (uint8_t *)avifAlloc ((size_t )uv_byte_size);
46+ const uint32_t new_stride_u = new_uv_width * bytes_per_pixel;
47+ const uint32_t new_stride_v = new_stride_u;
48+
49+ if (new_stride_u != 0 && new_uv_height > SIZE_MAX / new_stride_u) {
50+ return AVIF_RESULT_INVALID_ARGUMENT ;
51+ }
52+ const size_t uv_byte_size = (size_t )new_stride_u * new_uv_height;
53+ uint8_t * new_u = (uint8_t *)avifAlloc (uv_byte_size);
54+ uint8_t * new_v = (uint8_t *)avifAlloc (uv_byte_size);
5055 if (!new_u || !new_v) {
5156 avifFree (new_u);
5257 avifFree (new_v);
5358 return AVIF_RESULT_OUT_OF_MEMORY ;
5459 }
5560
56- if (UINT32_MAX / bytes_per_pixel < new_uv_width) {
57- return AVIF_RESULT_INVALID_ARGUMENT ;
58- }
59- const uint32_t new_stride_u = new_uv_width * bytes_per_pixel;
60- const uint32_t new_stride_v = new_uv_width * bytes_per_pixel;
61-
6261#if defined(AVIF_LIBYUV_ENABLED)
6362 if (image->depth == 8 ) {
6463 libyuv::ScalePlane (image->yuvPlanes [AVIF_CHAN_U ],
@@ -149,22 +148,18 @@ static avifResult DownsampleYUV444To420(avifImage* image) {
149148 const uint32_t new_uv_height = (uint32_t )(((uint64_t )image->height + 1 ) / 2 );
150149 const uint32_t bytes_per_pixel = (image->depth > 8 ) ? 2 : 1 ;
151150
152- const uint64_t uv_byte_size =
153- (uint64_t )new_uv_width * new_uv_height * bytes_per_pixel;
154- if (uv_byte_size > SIZE_MAX ) {
155- return AVIF_RESULT_INVALID_ARGUMENT ;
156- }
157- uint8_t * new_u = (uint8_t *)avifAlloc ((size_t )uv_byte_size);
158- uint8_t * new_v = (uint8_t *)avifAlloc ((size_t )uv_byte_size);
151+ const uint32_t new_stride_u = new_uv_width * bytes_per_pixel;
152+ const uint32_t new_stride_v = new_stride_u;
153+
154+ const size_t uv_byte_size = (size_t )new_stride_u * new_uv_height;
155+ uint8_t * new_u = (uint8_t *)avifAlloc (uv_byte_size);
156+ uint8_t * new_v = (uint8_t *)avifAlloc (uv_byte_size);
159157 if (!new_u || !new_v) {
160158 avifFree (new_u);
161159 avifFree (new_v);
162160 return AVIF_RESULT_OUT_OF_MEMORY ;
163161 }
164162
165- const uint32_t new_stride_u = new_uv_width * bytes_per_pixel;
166- const uint32_t new_stride_v = new_uv_width * bytes_per_pixel;
167-
168163#if defined(AVIF_LIBYUV_ENABLED)
169164 if (image->depth == 8 ) {
170165 libyuv::ScalePlane (image->yuvPlanes [AVIF_CHAN_U ],
0 commit comments