{"record":{"id":"460c7ba16f3f7062","repo":"Yalantis/uCrop","slug":"cimg-s-safe-size-specified-size-u-u-u-u-460c7b","errorCode":null,"errorMessage":"CImg<%s>::safe_size(): Specified size (%u,%u,%u,%u) overflows 'size_t'.","messagePattern":"CImg<(.+?)>::safe_size\\(\\): Specified size \\(%u,%u,%u,%u\\) overflows 'size_t'\\.","errorType":"exception","errorClass":"CImgArgumentException","httpStatus":null,"severity":"error","filePath":"ucrop/src/main/jni/CImg.h","lineNumber":12856,"sourceCode":"    typedef typename cimg::last<T,double>::type doubleT;\n\n    // Return 'dx*dy*dz*dc' as a 'size_t' and check no overflow occurs.\n    static size_t safe_size(const unsigned int dx, const unsigned int dy,\n                            const unsigned int dz, const unsigned int dc) {\n      if (!(dx && dy && dz && dc)) return 0;\n      size_t siz = (size_t)dx, osiz = siz;\n      if ((dy==1 || (siz*=dy)>osiz) &&\n          ((osiz = siz), dz==1 || (siz*=dz)>osiz) &&\n          ((osiz = siz), dc==1 || (siz*=dc)>osiz) &&\n          ((osiz = siz), sizeof(T)==1 || (siz*sizeof(T))>osiz)) {\n        if (siz>cimg_max_buf_size){\n          throw CImgArgumentException(\"CImg<%s>::safe_size(): Specified size (%u,%u,%u,%u) exceeds maximum \"\n                                      \"allowed buffer size of %lu \",\n                                      pixel_type(),dx,dy,dz,dc,cimg_max_buf_size);\n        }\n        return siz;\n      }\n      throw CImgArgumentException(\"CImg<%s>::safe_size(): Specified size (%u,%u,%u,%u) overflows 'size_t'.\",\n                                  pixel_type(),dx,dy,dz,dc);\n    }\n\n    //@}\n    //---------------------------\n    //\n    //! \\name Plugins\n    //@{\n    //---------------------------\n#ifdef cimg_plugin\n#include cimg_plugin\n#endif\n#ifdef cimg_plugin1\n#include cimg_plugin1\n#endif\n#ifdef cimg_plugin2\n#include cimg_plugin2\n#endif","sourceCodeStart":12838,"sourceCodeEnd":12874,"githubUrl":"https://github.com/Yalantis/uCrop/blob/f788b534b48c144edf786c8cddbf0e029e637804/ucrop/src/main/jni/CImg.h#L12838-L12874","documentation":"CImg::safe_size() throws CImgArgumentException when the pixel-count product dx*dy*dz*dc (and optionally *sizeof(T)) overflows size_t during its overflow-checked incremental multiplication. This happens before any allocation is attempted; the requested image is mathematically impossible to address on the current platform (typically 32-bit builds).","triggerScenarios":"Constructing/assigning an image with dimensions whose product exceeds SIZE_MAX, e.g. large 4D sizes on a 32-bit platform, or dimensions from a corrupted/lying file header.","commonSituations":"32-bit builds handling very large volumes; untrusted image headers with width*height near 2^32 or beyond; arithmetic bugs computing dimensions (uninitialized or multiplied variables).","solutions":["Move to a 64-bit build/platform, or reduce dimensions so the product fits size_t.","Pre-compute the size in 64-bit (unsigned long long) and validate before constructing the image.","Validate dimensions read from files against sane maximums before passing them to CImg."],"exampleFix":"// before\nCImg<unsigned char> img(w, h, z, c); // w*h*z*c overflows size_t on 32-bit\n// after\nunsigned long long n = (unsigned long long)w * h * z * c;\nif (n > SIZE_MAX) return fail();\nCImg<unsigned char> img(w, h, z, c);","handlingStrategy":"validation","validationCode":"unsigned long long n = (unsigned long long)dx*dy*dz*dc*sizeof(T);\nif (n > SIZE_MAX) return fail_overflow();","typeGuard":null,"tryCatchPattern":"try { CImg<T> img(dx,dy,dz,dc); }\ncatch (cimg_library::CImgArgumentException &e) { fprintf(stderr, \"%s\", e.what()); }","preventionTips":["Do all size math in 64-bit unsigned before constructing images.","On 32-bit builds, enforce much stricter dimension limits.","Never trust dimensions read directly from untrusted file headers."],"tags":["cimg","integer-overflow","memory"],"backgroundTag":"value-out-of-range","analyzedSha":"f788b534b48c144edf786c8cddbf0e029e637804","analyzedAt":"2026-09-08T08:36:04.887Z","contentChangedAt":"2026-09-08T08:36:04.887Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}