fix: prevent uint32_t overflow in avifSetTileConfiguration tile area

[uwezkhan]

fix: prevent uint32_t overflow in avifSetTileConfiguration tile area

When computing the tile count, width * height was performed as a
uint32_t multiplication. For images with dimensions whose product
exceeds UINT32_MAX (e.g. 100000x50000), this silently wraps around,
producing an incorrect tile count and potentially corrupt tile layout.

Fix by widening to uint64_t before multiplying, and clamping to
kMaxTiles using AVIF_MIN before downcasting back to uint32_t.
The existing bounds checks are preserved as a safety net.

Fixes: integer overflow in avifSetTileConfiguration (src/write.c)

[uwezkhan]

Thanks for the clarification. I’ve updated the implementation to use uint64_t for imageArea, safely cast the result back to uint32_t, and verified that the caller enforces width and height ≤ 65536.