From 9483961432ae65b911bb4208416ec5833ed736a5 Mon Sep 17 00:00:00 2001
From: Dirk Farin <dirk.farin@gmail.com>
Date: Wed, 11 Sep 2024 12:45:57 +0200
Subject: [PATCH] limit maximum memory allocation (should fix ClusterFuzz
 71389)

---
 libheif/pixelimage.cc | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/libheif/pixelimage.cc b/libheif/pixelimage.cc
index 0ec3092c2e..5583e1590b 100644
--- a/libheif/pixelimage.cc
+++ b/libheif/pixelimage.cc
@@ -21,6 +21,7 @@
 
 #include "pixelimage.h"
 #include "common_utils.h"
+#include "security_limits.h"
 
 #include <cassert>
 #include <cstring>
@@ -256,8 +257,12 @@ bool HeifPixelImage::ImagePlane::alloc(uint32_t width, uint32_t height, heif_cha
   stride = m_mem_width * bytes_per_pixel;
   stride = (stride + alignment - 1U) & ~(alignment - 1U);
 
+  if ((MAX_MEMORY_BLOCK_SIZE - (alignment + 1)) / stride < m_mem_height) {
+    return false;
+  }
+
   try {
-    allocated_mem = new uint8_t[m_mem_height * stride + alignment - 1];
+    allocated_mem = new uint8_t[static_cast<size_t>(m_mem_height) * stride + alignment - 1];
     uint8_t* mem_8 = allocated_mem;
 
     // shift beginning of image data to aligned memory position