Skip to content

Commit b984f48

Browse files
committed
Do not store colorproperties until alpha item is found
colorProperties could be pointing to a dangling pointer if findAlphaItem() resizes the meta.items array. Manual cherry-pick of PR #1808 to the v1.0.x branch.
1 parent 6022e7d commit b984f48

2 files changed

Lines changed: 5 additions & 1 deletion

File tree

CHANGELOG.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
66

77
## [Unreleased]
88

9+
### Changed
10+
* Fix memory errors reported in crbug.com/1504792.
11+
912
## [1.0.2] - 2023-11-16
1013

1114
### Changed

src/read.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3938,7 +3938,6 @@ avifResult avifDecoderReset(avifDecoder * decoder)
39383938
avifDiagnosticsPrintf(&decoder->diag, "Primary item not found");
39393939
return AVIF_RESULT_MISSING_IMAGE_ITEM;
39403940
}
3941-
colorProperties = &colorItem->properties;
39423941
if (!memcmp(colorItem->type, "grid", 4)) {
39433942
avifROData readData;
39443943
AVIF_CHECKRES(avifDecoderItemRead(colorItem, decoder->io, &readData, 0, 0, data->diag));
@@ -3995,6 +3994,8 @@ avifResult avifDecoderReset(avifDecoder * decoder)
39953994
}
39963995
}
39973996

3997+
colorProperties = &colorItem->properties;
3998+
39983999
// Find Exif and/or XMP metadata, if any
39994000
AVIF_CHECKRES(avifDecoderFindMetadata(decoder, data->meta, decoder->image, colorItem->id));
40004001

0 commit comments

Comments
 (0)