Commit 909724e5 for libheif
commit 909724e51bce3d212a9c1ed2e49e5f3421e57cd3
Author: Dirk Farin <dirk.farin@gmail.com>
Date: Wed Mar 4 11:25:16 2026 +0100
check Box_snuc memory allocation against max total memory use
diff --git a/libheif/codecs/uncompressed/unc_boxes.cc b/libheif/codecs/uncompressed/unc_boxes.cc
index 5a02862a..4ca144be 100644
--- a/libheif/codecs/uncompressed/unc_boxes.cc
+++ b/libheif/codecs/uncompressed/unc_boxes.cc
@@ -1289,6 +1289,11 @@ Error Box_snuc::parse(BitstreamRange& range, const heif_security_limits* limits)
"snuc image dimensions exceed security limit."};
}
+ Error err = m_memory_handle.alloc(2 * sizeof(float) * num_pixels, limits, "snuc box");
+ if (err) {
+ return err;
+ }
+
m_nuc.nuc_gains.resize(num_pixels);
for (uint64_t i = 0; i < num_pixels; i++) {
m_nuc.nuc_gains[i] = range.read_float32();
diff --git a/libheif/codecs/uncompressed/unc_boxes.h b/libheif/codecs/uncompressed/unc_boxes.h
index d6a06243..a7fa4a30 100644
--- a/libheif/codecs/uncompressed/unc_boxes.h
+++ b/libheif/codecs/uncompressed/unc_boxes.h
@@ -452,6 +452,7 @@ public:
protected:
Error parse(BitstreamRange& range, const heif_security_limits* limits) override;
+ MemoryHandle m_memory_handle;
SensorNonUniformityCorrection m_nuc;
};