What causes "CImg ::safe_size(): Specified size (%u,%u,%u,%u) overflows 'size_t'." in Yalantis/uCrop?

Move to a 64-bit build/platform, or reduce dimensions so the product fits size_t.

Yalantis/uCrop · error · CImgArgumentException

CImg<%s>::safe_size(): Specified size (%u,%u,%u,%u) overflow

Error message

CImg<%s>::safe_size(): Specified size (%u,%u,%u,%u) overflows 'size_t'.

What it means

CImg::safe_size() throws CImgArgumentException when the pixel-count product dx*dy*dz*dc (and optionally *sizeof(T)) overflows size_t during its overflow-checked incremental multiplication. This happens before any allocation is attempted; the requested image is mathematically impossible to address on the current platform (typically 32-bit builds).

Source

Thrown at ucrop/src/main/jni/CImg.h:12856

    typedef typename cimg::last<T,double>::type doubleT;

    // Return 'dx*dy*dz*dc' as a 'size_t' and check no overflow occurs.
    static size_t safe_size(const unsigned int dx, const unsigned int dy,
                            const unsigned int dz, const unsigned int dc) {
      if (!(dx && dy && dz && dc)) return 0;
      size_t siz = (size_t)dx, osiz = siz;
      if ((dy==1 || (siz*=dy)>osiz) &&
          ((osiz = siz), dz==1 || (siz*=dz)>osiz) &&
          ((osiz = siz), dc==1 || (siz*=dc)>osiz) &&
          ((osiz = siz), sizeof(T)==1 || (siz*sizeof(T))>osiz)) {
        if (siz>cimg_max_buf_size){
          throw CImgArgumentException("CImg<%s>::safe_size(): Specified size (%u,%u,%u,%u) exceeds maximum "
                                      "allowed buffer size of %lu ",
                                      pixel_type(),dx,dy,dz,dc,cimg_max_buf_size);
        }
        return siz;
      }
      throw CImgArgumentException("CImg<%s>::safe_size(): Specified size (%u,%u,%u,%u) overflows 'size_t'.",
                                  pixel_type(),dx,dy,dz,dc);
    }

    //@}
    //---------------------------
    //
    //! \name Plugins
    //@{
    //---------------------------
#ifdef cimg_plugin
#include cimg_plugin
#endif
#ifdef cimg_plugin1
#include cimg_plugin1
#endif
#ifdef cimg_plugin2
#include cimg_plugin2
#endif

View on GitHub (pinned to f788b534b4)

Solutions

Move to a 64-bit build/platform, or reduce dimensions so the product fits size_t.
Pre-compute the size in 64-bit (unsigned long long) and validate before constructing the image.
Validate dimensions read from files against sane maximums before passing them to CImg.

Example fix

// before
CImg<unsigned char> img(w, h, z, c); // w*h*z*c overflows size_t on 32-bit
// after
unsigned long long n = (unsigned long long)w * h * z * c;
if (n > SIZE_MAX) return fail();
CImg<unsigned char> img(w, h, z, c);

Defensive patterns

Strategy: validation

Validate before calling

unsigned long long n = (unsigned long long)dx*dy*dz*dc*sizeof(T);
if (n > SIZE_MAX) return fail_overflow();

Try / catch

try { CImg<T> img(dx,dy,dz,dc); }
catch (cimg_library::CImgArgumentException &e) { fprintf(stderr, "%s", e.what()); }

Prevention

Do all size math in 64-bit unsigned before constructing images.
On 32-bit builds, enforce much stricter dimension limits.
Never trust dimensions read directly from untrusted file headers.

When it happens

Trigger: Constructing/assigning an image with dimensions whose product exceeds SIZE_MAX, e.g. large 4D sizes on a 32-bit platform, or dimensions from a corrupted/lying file header.

Common situations: 32-bit builds handling very large volumes; untrusted image headers with width*height near 2^32 or beyond; arithmetic bugs computing dimensions (uninitialized or multiplied variables).

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

AI-assisted analysis of Yalantis/uCrop@f788b534b4 (2026-09-08). Data as JSON: /api/errors/460c7ba16f3f7062. Report an issue: GitHub.