Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cherry pick unused item #1996

Merged

Conversation

wantehchang
Copy link
Collaborator

No description provided.

This is a manual cherry-pick of commit 59f1c9a.

This fixes the case where the maximum ID is UINT32_MAX.

BUG=oss-fuzz:65657
@wantehchang
Copy link
Collaborator Author

@vrabaud Vincent: FYI.

@vigneshvg @y-guyon Vignesh, Yannis: The two commits in this pull request will be merged as separate commits. The first commit is a revert of #1974. The second commit is a cherry-pick of #1922. You only need to review the second commit.

Copy link
Collaborator

@y-guyon y-guyon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you

}
}
} while (isUsed && newItemID != 0);
*alphaItem = avifMetaFindItem(colorItem->meta, newItemID); // Create new empty item.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is fine because

libavif/src/read.c

Lines 773 to 777 in e6edfd7

static avifDecoderItem * avifMetaFindItem(avifMeta * meta, uint32_t itemID, avifDiagnostics * diag)
{
if (itemID == 0) {
return NULL;
}

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes. If newItemID is 0, avifMetaFindItem(colorItem->meta, newItemID) fails and returns NULL. So we will set result to AVIF_RESULT_OUT_OF_MEMORY in the next line. AVIF_RESULT_OUT_OF_MEMORY is not the right error code for this condition, but at least we will fail rather than keep going.

However, if all the item IDs in the colorItem->meta->items array are nonzero and distinct (I believe this is an invariant that we maintain), then newItemID cannot possibly be zero. So we could add assert(newItemID != 0) after the do-while loop to indicate our belief.

Note: I suggested removing && newItemID != 0 from the condition of the do-while loop, but Vincent was uncomfortable with a potential infinite loop if we fail to maintain the invariant.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just realized that my previous comment is wrong:

However, if all the item IDs in the colorItem->meta->items array are nonzero and distinct (I believe this is an invariant that we maintain), then newItemID cannot possibly be zero. [...]

All we need to prove newItemID cannot be zero is that colorItem->meta->items.count < UINT32_MAX - 1. If there are fewer than UINT32_MAX - 1 elements in the colorItem->meta->items array, then there must be a nonzero uint32_t value that is not an item ID in the colorItem->meta->items array.

Since the colorItem->meta->items.count < UINT32_MAX - 1 condition is guaranteed by the check at line 3700, the only way the do-while loop may loop infinitely is that the loop itself has a bug. The do-while loop is short and can be reviewed thoroughly. So I think the && newItemID != 0 check can be safely omitted.

@wantehchang wantehchang merged commit 030cace into AOMediaCodec:v1.0.x Feb 7, 2024
15 checks passed
@wantehchang wantehchang deleted the cherry-pick-unused-item-id branch February 7, 2024 20:32
@y-guyon
Copy link
Collaborator

y-guyon commented Feb 8, 2024

Related: #1993

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants