[FFmpeg-devel] [PATCH] avutil/imgutils: av_image_check_size2() ensure width and height fit in 32bit

[Michael Niedermayer]

On Tue, Jul 09, 2024 at 03:17:58PM +0200, Anton Khirnov wrote:
> > ensure width and height fit in 32bit
> 
> why?

because not everyone wants undefined behavior
because not everyone wants security issues
because we dont support width and height > 32bit and its easier to check in a central place
because the changed codes purpose is to check if the image paramaters are
    within what we support, and width of 100 billion is not. You can try
    all encoders with 100billion width. Then try to decode.
    Iam curious, how many work, how many fail and how they fail
    how many invalid bitstreams with no warning, how many undefined behaviors, ...

Simply building FFmpeg on a platform with 64bit ints doesnt update
ISO and ITU standards to allow larger values

thx

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Many things microsoft did are stupid, but not doing something just because
microsoft did it is even more stupid. If everything ms did were stupid they
would be bankrupt already.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20240709/86d0dd8f/attachment.sig>