Commit f4901e73 for libheif

commit f4901e7381be70f16c57e6fd73d4c14d7eb2542f
Author: Dirk Farin <dirk.farin@gmail.com>
Date:   Fri May 15 15:39:18 2026 +0200

    also prevent overflow in memcpy source argument (#1779)

diff --git a/libheif/image/pixelimage.cc b/libheif/image/pixelimage.cc
index 4fad1c02..f2bfe85a 100644
--- a/libheif/image/pixelimage.cc
+++ b/libheif/image/pixelimage.cc
@@ -1161,7 +1161,7 @@ void HeifPixelImage::zero_region(uint32_t x0, uint32_t y0, uint32_t w, uint32_t
     size_t width_bytes = static_cast<size_t>(cw) * bytes_per_pixel;

     for (uint32_t y = 0; y < ch; y++) {
-      memset(data + cx0 * bytes_per_pixel + (cy0 + y) * stride, 0, width_bytes);
+      memset(data + static_cast<size_t>(cx0) * bytes_per_pixel + (cy0 + y) * stride, 0, width_bytes);
     }
   }
 }
diff --git a/libheif/plugins/decoder_aom.cc b/libheif/plugins/decoder_aom.cc
index 9637da35..2e693cb2 100644
--- a/libheif/plugins/decoder_aom.cc
+++ b/libheif/plugins/decoder_aom.cc
@@ -304,7 +304,7 @@ static heif_error get_next_image_from_decoder(aom_decoder* decoder,
     int bytes_per_pixel = (bpp + 7) / 8;

     for (int y = 0; y < h; y++) {
-      memcpy(dst_mem + y * dst_stride, data + y * stride, static_cast<size_t>(w) * bytes_per_pixel);
+      memcpy(dst_mem + y * dst_stride, data + static_cast<size_t>(y) * stride, static_cast<size_t>(w) * bytes_per_pixel);
     }
   }

diff --git a/libheif/plugins/decoder_dav1d.cc b/libheif/plugins/decoder_dav1d.cc
index ff6e8905..653c8f53 100644
--- a/libheif/plugins/decoder_dav1d.cc
+++ b/libheif/plugins/decoder_dav1d.cc
@@ -375,7 +375,7 @@ heif_error dav1d_decode_next_image2(void* decoder_raw, heif_image** out_img,
     const int bytes_per_pixel = (bpp + 7) / 8;

     for (uint32_t y = 0; y < h; y++) {
-      memcpy(dst_mem + y * dst_stride, data + y * stride, static_cast<size_t>(w) * bytes_per_pixel);
+      memcpy(dst_mem + y * dst_stride, data + static_cast<size_t>(y) * stride, static_cast<size_t>(w) * bytes_per_pixel);
     }
   }

diff --git a/libheif/plugins/decoder_ffmpeg.cc b/libheif/plugins/decoder_ffmpeg.cc
index fb601d21..dba6c19e 100644
--- a/libheif/plugins/decoder_ffmpeg.cc
+++ b/libheif/plugins/decoder_ffmpeg.cc
@@ -457,7 +457,7 @@ static heif_error ffmpeg_av_decode(ffmpeg_decoder* decoder, AVCodecContext* av_d
       int bytes_per_pixel = (bpp + 7) / 8;

       for (int y = 0; y < h; y++) {
-        memcpy(dst_mem + y * dst_stride, data + y * stride, static_cast<size_t>(w) * bytes_per_pixel);
+        memcpy(dst_mem + y * dst_stride, data + static_cast<size_t>(y) * stride, static_cast<size_t>(w) * bytes_per_pixel);
       }
     }

diff --git a/libheif/plugins/decoder_libde265.cc b/libheif/plugins/decoder_libde265.cc
index 3277152a..cd53aece 100644
--- a/libheif/plugins/decoder_libde265.cc
+++ b/libheif/plugins/decoder_libde265.cc
@@ -161,7 +161,7 @@ static heif_error convert_libde265_image_to_heif_image(libde265_decoder* decoder
     int bytes_per_pixel = (bpp + 7) / 8;

     for (int y = 0; y < h; y++) {
-      memcpy(dst_mem + y * dst_stride, data + y * stride, static_cast<size_t>(w) * bytes_per_pixel);
+      memcpy(dst_mem + y * dst_stride, data + static_cast<size_t>(y) * stride, static_cast<size_t>(w) * bytes_per_pixel);
     }
   }

diff --git a/libheif/plugins/decoder_vvdec.cc b/libheif/plugins/decoder_vvdec.cc
index cc1b8405..743728ed 100644
--- a/libheif/plugins/decoder_vvdec.cc
+++ b/libheif/plugins/decoder_vvdec.cc
@@ -377,7 +377,7 @@ heif_error vvdec_decode_next_image2(void* decoder_raw, heif_image** out_img,
     int bytes_per_pixel = (bpp + 7) / 8;

     for (int y = 0; y < h; y++) {
-      memcpy(dst_mem + y * dst_stride, data + y * stride, static_cast<size_t>(w) * bytes_per_pixel);
+      memcpy(dst_mem + y * dst_stride, data + static_cast<size_t>(y) * stride, static_cast<size_t>(w) * bytes_per_pixel);
     }

 #if 0