Skip to content

Commit 4ac4fff

Browse files
committed
switch extent merge overflow checks to assertions and use writeOffset
1 parent d0b72c6 commit 4ac4fff

1 file changed

Lines changed: 8 additions & 17 deletions

File tree

src/read.c

Lines changed: 8 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1534,24 +1534,15 @@ static avifResult avifDecoderItemRead(avifDecoderItem * item,
15341534
item->mergedExtents.size = bytesToRead;
15351535
} else {
15361536
AVIF_ASSERT_OR_RETURN(item->ownsMergedExtents);
1537-
AVIF_ASSERT_OR_RETURN(front);
1537+
15381538
size_t writeOffset = (size_t)(front - item->mergedExtents.data);
1539-
// Validate that the write will not exceed the allocated buffer
1540-
if (writeOffset > item->mergedExtents.size ||
1541-
bytesToRead > item->mergedExtents.size - writeOffset) {
1542-
1543-
avifDiagnosticsPrintf(
1544-
diag,
1545-
"Item ID %u extent would overflow merge buffer (buffer size: %zu, current offset: %zu, bytes to write: %zu)",
1546-
item->id,
1547-
item->mergedExtents.size,
1548-
writeOffset,
1549-
bytesToRead);
1550-
1551-
return AVIF_RESULT_INTERNAL_ERROR;
1552-
}
1553-
memcpy(front, offsetBuffer.data, bytesToRead);
1554-
front += bytesToRead;
1539+
1540+
AVIF_ASSERT_OR_RETURN(writeOffset < item->mergedExtents.size);
1541+
AVIF_ASSERT_OR_RETURN(bytesToRead <= item->mergedExtents.size - writeOffset);
1542+
1543+
uint8_t *dst = item->mergedExtents.data + writeOffset;
1544+
memcpy(dst, offsetBuffer.data, bytesToRead);
1545+
writeOffset += bytesToRead;
15551546
}
15561547

15571548
remainingBytes -= bytesToRead;

0 commit comments

Comments
 (0)