Commit b1bd1c00 for libheif

commit b1bd1c000e596f09ecd7bae87f95b88c21a6dc4a
Author: Dirk Farin <dirk.farin@gmail.com>
Date:   Sat Mar 28 00:37:53 2026 +0100

    fix computation of size of inline region mask

diff --git a/libheif/region.cc b/libheif/region.cc
index fc282fbf..e5c2fd8a 100644
--- a/libheif/region.cc
+++ b/libheif/region.cc
@@ -458,7 +458,17 @@ Error RegionGeometry_InlineMask::parse(const std::vector<uint8_t>& data,
     };
   }

-  if (width / 8 + 1 > UINT32_MAX / height) {
+  // Mask is stored with one bit per pixel, no padding exists at the end of the line.
+  // Only the very last byte is padded.
+
+  // error if:
+  // (width * height + 7) / 8 > UINT32_MAX
+  // more strict:
+  // (width * height + height) / 8 > UINT32_MAX
+  // width/8 * height + 1 > UINT32_MAX
+
+  uint64_t bytes_for_mask = (static_cast<uint64_t>(width) * height + 7) / 8;
+  if (bytes_for_mask > std::numeric_limits<ptrdiff_t>::max()) {
     return {
       heif_error_Memory_allocation_error,
       heif_suberror_Unspecified,
@@ -474,18 +484,17 @@ Error RegionGeometry_InlineMask::parse(const std::vector<uint8_t>& data,
     };
   }

-  unsigned int additionalBytesRequired = width * height / 8;
-  if (data.size() - *dataOffset < additionalBytesRequired) {
+  if (data.size() - *dataOffset < bytes_for_mask) {
         return Error(heif_error_Invalid_input, heif_suberror_Invalid_region_data,
                  "Insufficient data remaining for inline mask region data[]");
   }

-  if (auto err = m_memory_handle.alloc(additionalBytesRequired, limits, "region mask")) {
+  if (auto err = m_memory_handle.alloc(bytes_for_mask, limits, "region mask")) {
     return err;
   }

-  mask_data.resize(additionalBytesRequired);
-  std::copy(data.begin() + *dataOffset, data.begin() + *dataOffset + additionalBytesRequired, mask_data.begin());
+  mask_data.resize(bytes_for_mask);
+  std::copy(data.begin() + *dataOffset, data.begin() + *dataOffset + static_cast<ptrdiff_t>(bytes_for_mask), mask_data.begin());
   return Error::Ok;
 }