Use rgb.rowBytes in overflow check

fdintino · Jan 30, 2025 · d0b4f70 · d0b4f70
1 parent f6862f7
commit d0b4f70
Showing 1 changed file with 5 additions and 8 deletions.
diff --git a/src/_avif.c b/src/_avif.c
@@ -805,7 +805,6 @@ _decoder_get_frame(AvifDecoderObject *self, PyObject *args) {
     avifDecoder *decoder;
     avifImage *image;
     uint32_t frame_index;
-    uint32_t row_bytes;
 
     decoder = self->decoder;
 
@@ -838,13 +837,6 @@ _decoder_get_frame(AvifDecoderObject *self, PyObject *args) {
         rgb.ignoreAlpha = AVIF_TRUE;
     }
 
-    row_bytes = rgb.width * avifRGBImagePixelSize(&rgb);
-
-    if (rgb.height > PY_SSIZE_T_MAX / row_bytes) {
-        PyErr_SetString(PyExc_MemoryError, "Integer overflow in pixel size");
-        return NULL;
-    }
-
     result = avifRGBImageAllocatePixels(&rgb);
     if (result != AVIF_RESULT_OK) {
         PyErr_Format(
@@ -869,6 +861,11 @@ _decoder_get_frame(AvifDecoderObject *self, PyObject *args) {
         return NULL;
     }
 
+    if (rgb.height > PY_SSIZE_T_MAX / rgb.rowBytes) {
+        PyErr_SetString(PyExc_MemoryError, "Integer overflow in pixel size");
+        return NULL;
+    }
+
     size = rgb.rowBytes * rgb.height;
 
     bytes = PyBytes_FromStringAndSize((char *)rgb.pixels, size);