Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bail out of avifDecoderParse() if an essential-required item property is not flagged as essential #537

Open
wants to merge 6 commits into
base: main
Choose a base branch
from
17 changes: 17 additions & 0 deletions src/read.c
Original file line number Diff line number Diff line change
Expand Up @@ -1481,6 +1481,23 @@ static avifBool avifParseItemPropertyAssociation(avifMeta * meta, const uint8_t
}
}
if (supportedType) {
if (!essential) {
// Verify that it is legal for this property to not be flagged as essential. Any
// types in this list are *required* in the spec to be flagged as essential when
// associated with an item.
static const char * essentialTypes[] = {
joedrago marked this conversation as resolved.
Show resolved Hide resolved
"av1C" // AVIF: Section 2.2.1: "This property shall be marked as essential."
Copy link

@baumanj baumanj Mar 11, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"av1C" // AVIF: Section 2.2.1: "This property shall be marked as essential."
"av1C" // AVIF: Section 2.2.1: "This property shall be marked as essential."
"a1op" // AVIF: Section 2.3.2.1: "If associated, it shall be marked as essential."

Not sure if a1op needs to be handled differently here.

Also, should there be an opposite check for a1lx since the spec says "If associated, it shall not be marked as essential"

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm. I'm thinking about removing lsel from the list for now and just adding boxes to this list as I add support for new boxes. lsel isn't written or read at all right now, so it seems odd to preemptively block a read on it.

joedrago marked this conversation as resolved.
Show resolved Hide resolved
};
size_t essentialTypesCount = sizeof(essentialTypes) / sizeof(essentialTypes[0]);
for (size_t i = 0; i < essentialTypesCount; ++i) {
if (!memcmp(srcProp->type, essentialTypes[i], 4)) {
// An essential-required property is not flagged as essential, bail out
return AVIF_FALSE;
}
}
}

// Supported and valid; associate it with this item.
avifProperty * dstProp = (avifProperty *)avifArrayPushPtr(&item->properties);
memcpy(dstProp, srcProp, sizeof(avifProperty));
} else {
Expand Down