avifMetaDestroy: check meta pointer before accessing

[jzern]

fixes a NULL dereference should avifMetaCreate() fail and
avifDecoderDataDestroy() is called to clean up.

Found by Nallocfuzz (https://github.com/catenacyber/nallocfuzz).

[wantehchang]

Thanks for the fix. I suggest two changes.

[wantehchang]

Nit: The current style in src/read.c is to have the caller handle this. For example, see the second avifMetaDestroy() call in avifDecoderDataDestroy():

static void avifDecoderDataDestroy(avifDecoderData * data)
{
    avifMetaDestroy(data->meta);
    for (uint32_t i = 0; i < data->tracks.count; ++i) {
        avifTrack * track = &data->tracks.track[i];
        if (track->sampleTable) {
            avifSampleTableDestroy(track->sampleTable);
        }
        if (track->meta) {
            avifMetaDestroy(track->meta);
        }
    }
    avifArrayDestroy(&data->tracks);
    avifDecoderDataClearTiles(data);
    avifArrayDestroy(&data->tiles);
    avifFree(data);
}

So I suggest adding a similar null pointer check to the first avifMetaDestroy() call in avifDecoderDataDestroy().

    if (data->meta) {
        avifMetaDestroy(data->meta);
    }

[jzern]

Nit: The current style in src/read.c is to have the caller handle this. For example, see the second avifMetaDestroy() call in avifDecoderDataDestroy():

static void avifDecoderDataDestroy(avifDecoderData * data)
{
    avifMetaDestroy(data->meta);
    for (uint32_t i = 0; i < data->tracks.count; ++i) {
        avifTrack * track = &data->tracks.track[i];
        if (track->sampleTable) {
            avifSampleTableDestroy(track->sampleTable);
        }
        if (track->meta) {
            avifMetaDestroy(track->meta);
        }
    }
    avifArrayDestroy(&data->tracks);
    avifDecoderDataClearTiles(data);
    avifArrayDestroy(&data->tiles);
    avifFree(data);
}

So I suggest adding a similar null pointer check to the first avifMetaDestroy() call in avifDecoderDataDestroy().

    if (data->meta) {
        avifMetaDestroy(data->meta);
    }

Done

[wantehchang]

The commit message should also acknowledge the person who ran nallocfuzz and reported this bug to us (Philippe Antoine).

[jzern]

The commit message should also acknowledge the person who ran nallocfuzz and reported this bug to us (Philippe Antoine).

Found by Nallocfuzz (https://github.com/catenacyber/nallocfuzz).

This was the format I used in other projects, that was suggested by Philippe. I can add his name though.

[wantehchang]

LGTM.