Skip to content

BUG: Refuse a header whose dimensions overflow the voxel count #68

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hjmjohnson merged 2 commits into from
Sep 22, 2026
Merged

BUG: Refuse a header whose dimensions overflow the voxel count #68

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4eafd2c
BUG: Refuse a header whose dimensions overflow the voxel count
gdevenyi Aug 15, 2026
191f84f
BUG: Guard the voxel count in the NIFTI-1 library too
gdevenyi Sep 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 24 additions & 2 deletions nifti2/nifti2_io.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4807,8 +4807,14 @@ nifti_image* nifti_convert_n1hdr2nim(nifti_1_header nhdr, const char * fname)
nim->nv = nim->dim[6] = nhdr.dim[6];
nim->nw = nim->dim[7] = nhdr.dim[7];

for( ii=1, nim->nvox=1; ii <= nhdr.dim[0]; ii++ )
/* the product of the dimensions becomes an allocation size, so refuse
the header rather than let it wrap */
for( ii=1, nim->nvox=1; ii <= nhdr.dim[0]; ii++ ){
if( nhdr.dim[ii] > 0 && nim->nvox > INT64_MAX / nhdr.dim[ii] ){
free(nim); ERREX("dim[] overflows the voxel count");
}
nim->nvox *= nhdr.dim[ii];
}

/**- set the type of data in voxels and how many bytes per voxel */

Expand All @@ -4817,6 +4823,11 @@ nifti_image* nifti_convert_n1hdr2nim(nifti_1_header nhdr, const char * fname)
nifti_datatype_sizes( nim->datatype , &(nim->nbyper) , &(nim->swapsize) ) ;
if( nim->nbyper == 0 ){ free(nim); ERREX("bad datatype"); }

/* nifti_get_volsize() multiplies these two */
if( nim->nvox > INT64_MAX / nim->nbyper ){
free(nim); ERREX("dim[] and datatype overflow the volume size");
}

/**- set the grid spacings */

nim->dx = nim->pixdim[1] = nhdr.pixdim[1] ;
Expand Down Expand Up @@ -5077,8 +5088,14 @@ nifti_image* nifti_convert_n2hdr2nim(nifti_2_header nhdr, const char * fname)
nim->nv = nim->dim[6] = nhdr.dim[6];
nim->nw = nim->dim[7] = nhdr.dim[7];

for( ii=1, nim->nvox=1; ii <= nhdr.dim[0]; ii++ )
/* the product of the dimensions becomes an allocation size, so refuse
the header rather than let it wrap */
for( ii=1, nim->nvox=1; ii <= nhdr.dim[0]; ii++ ){
if( nhdr.dim[ii] > 0 && nim->nvox > INT64_MAX / nhdr.dim[ii] ){
free(nim); ERREX("dim[] overflows the voxel count");
}
nim->nvox *= nhdr.dim[ii];
}

/**- set the type of data in voxels and how many bytes per voxel */

Expand All @@ -5087,6 +5104,11 @@ nifti_image* nifti_convert_n2hdr2nim(nifti_2_header nhdr, const char * fname)
nifti_datatype_sizes( nim->datatype , &(nim->nbyper) , &(nim->swapsize) ) ;
if( nim->nbyper == 0 ){ free(nim); ERREX("bad datatype"); }

/* nifti_get_volsize() multiplies these two */
if( nim->nvox > INT64_MAX / nim->nbyper ){
free(nim); ERREX("dim[] and datatype overflow the volume size");
}

/**- set the grid spacings */

nim->dx = nim->pixdim[1] = nhdr.pixdim[1] ;
Expand Down
14 changes: 13 additions & 1 deletion niftilib/nifti1_io.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3766,8 +3766,15 @@ nifti_image* nifti_convert_nhdr2nim(struct nifti_1_header nhdr,
nim->nv = nim->dim[6] = nhdr.dim[6];
nim->nw = nim->dim[7] = nhdr.dim[7];

for( ii=1, nim->nvox=1; ii <= nhdr.dim[0]; ii++ )
/* the product of the dimensions becomes an allocation size, so refuse
the header rather than let it wrap. nvox is a size_t here, where the
NIFTI-2 library uses int64_t, so the bound is SIZE_MAX. */
for( ii=1, nim->nvox=1; ii <= nhdr.dim[0]; ii++ ){
if( nhdr.dim[ii] > 0 && nim->nvox > SIZE_MAX / (size_t)nhdr.dim[ii] ){
free(nim); ERREX("dim[] overflows the voxel count");
}
nim->nvox *= nhdr.dim[ii];
}

/**- set the type of data in voxels and how many bytes per voxel */

Expand All @@ -3776,6 +3783,11 @@ nifti_image* nifti_convert_nhdr2nim(struct nifti_1_header nhdr,
nifti_datatype_sizes( nim->datatype , &(nim->nbyper) , &(nim->swapsize) ) ;
if( nim->nbyper == 0 ){ free(nim); ERREX("bad datatype"); }

/* nifti_get_volsize() multiplies these two */
if( nim->nvox > SIZE_MAX / (size_t)nim->nbyper ){
free(nim); ERREX("dim[] and datatype overflow the volume size");
}

/**- set the grid spacings */

nim->dx = nim->pixdim[1] = nhdr.pixdim[1] ;
Expand Down
Loading