detect zero Bayer pattern size (OSS-Fuzz 371546810)

strukturag · Oct 5, 2024 · 71eed2e · 71eed2e
1 parent 6d5888c
commit 71eed2e
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/libheif/codecs/uncompressed/unc_boxes.cc b/libheif/codecs/uncompressed/unc_boxes.cc
@@ -628,11 +628,17 @@ Error Box_cpat::parse(BitstreamRange& range)
   m_pattern_height = range.read16();
 
   if (m_pattern_width * m_pattern_height > MAX_BAYER_PATTERN_PIXELS) {
-    return {heif_error_Unsupported_filetype,
+    return {heif_error_Invalid_input,
             heif_suberror_Security_limit_exceeded,
             "Maximum Bayer pattern size exceeded."};
   }
 
+  if (m_pattern_width == 0 || m_pattern_height == 0) {
+    return {heif_error_Invalid_input,
+            heif_suberror_Invalid_parameter_value,
+            "Zero Bayer pattern size."};
+  }
+
   m_components.resize(m_pattern_width * m_pattern_height);
 
   for (uint16_t i = 0; i < m_pattern_height; i++) {