commit ad6b520f23f835baedc58aac62576ae40ea3944b
author Wan-Teh Chang <wtc@google.com> Thu Nov 13 20:42:44 2025 -0800
committer Wan-Teh Chang <wtc@google.com> Mon Nov 17 07:43:59 2025 -0800
tree 9de205e2da17a0460d4e82fca21831c2b806dcb1
parent af4aec8901bc318b802d7111ccdbc09b9f13b8b6

Initialize cicpSet in avifDecoderFindGainMapItem()

avifDecoderFindGainMapItem() should initialize the local variable
cicpSet to AVIF_FALSE, because avifReadColorNclxProperty() leaves its
output parameter cicpSet unchanged if no colr nclx property was read.

Bug: https://issues.oss-fuzz.com/460535483

src/read.c

diff --git a/src/read.c b/src/read.c
index 40914db..8a3ed82 100644
--- a/src/read.c
+++ b/src/read.c
@@ -5775,7 +5775,7 @@
     avifTransferCharacteristics transferCharacteristics = AVIF_TRANSFER_CHARACTERISTICS_UNSPECIFIED;
     avifMatrixCoefficients matrixCoefficients = AVIF_MATRIX_COEFFICIENTS_UNSPECIFIED;
     avifRange yuvRange = AVIF_RANGE_FULL;
-    avifBool cicpSet;
+    avifBool cicpSet = AVIF_FALSE;
     // Look for a colr nclx box. Other colr box types (e.g. ICC) are not supported.
     AVIF_CHECKRES(
         avifReadColorNclxProperty(&gainMapItemTmp->properties, &colorPrimaries, &transferCharacteristics, &matrixCoefficients, &yuvRange, &cicpSet));