diff --git a/source/planar_functions.cc b/source/planar_functions.cc index 3b703920..89e58ff6 100644 --- a/source/planar_functions.cc +++ b/source/planar_functions.cc @@ -43,8 +43,11 @@ void CopyPlane(const uint8_t* src_y, dst_y = dst_y + (height - 1) * dst_stride_y; dst_stride_y = -dst_stride_y; } - // Coalesce rows. - if (src_stride_y == width && dst_stride_y == width) { + // Coalesce rows. Skip if width*height would overflow int — the row kernels + // (CopyRow_ERMS / CopyRow_C) sign-extend a negative width to a huge size_t + // and copy unbounded. Falling through copies the same bytes row-by-row. + if (src_stride_y == width && dst_stride_y == width && + (int64_t)width * (int64_t)height <= 2147483647LL) { width *= height; height = 1; src_stride_y = dst_stride_y = 0;