Commit a70ed5e7 for libheif

commit a70ed5e76e7ce149da482daa7816e8e7a78e2a04
Author: Dirk Farin <dirk.farin@gmail.com>
Date:   Fri May 15 15:41:20 2026 +0200

    prevent int overflow in HeifPixelImage::fill_channel()

diff --git a/libheif/image/pixelimage.cc b/libheif/image/pixelimage.cc
index f2bfe85a..d5de201a 100644
--- a/libheif/image/pixelimage.cc
+++ b/libheif/image/pixelimage.cc
@@ -969,7 +969,7 @@ void HeifPixelImage::fill_channel(heif_channel dst_channel, uint16_t value)
     uint8_t* dst;
     size_t dst_stride = 0;
     dst = get_channel_memory(dst_channel, &dst_stride);
-    uint32_t width_bytes = width * num_interleaved;
+    size_t width_bytes = static_cast<size_t>(width) * num_interleaved;

     for (uint32_t y = 0; y < height; y++) {
       memset(dst + y * dst_stride, value, width_bytes);
@@ -981,8 +981,9 @@ void HeifPixelImage::fill_channel(heif_channel dst_channel, uint16_t value)
     dst = get_channel_memory<uint16_t>(dst_channel, &dst_stride);
     dst_stride /= sizeof(uint16_t);

+    size_t row_size = static_cast<size_t>(width) * num_interleaved;
     for (uint32_t y = 0; y < height; y++) {
-      for (uint32_t x = 0; x < width * num_interleaved; x++) {
+      for (size_t x = 0; x < row_size; x++) {
         dst[y * dst_stride + x] = value;
       }
     }