commit b8c89448f2e36bf05f7b852e79d67f31722e9710
author Wan-Teh Chang <wtc@google.com> Fri Mar 19 14:17:57 2021 -0700
committer GitHub <noreply@github.com> Fri Mar 19 14:17:57 2021 -0700
tree 4eedc3a4b86ad4cacc10008b22c5ca67773d3bc2
parent 620f4911427d04607c07a2975730e395ed0bee83

Clean up the code that checks imageCountLimit (#549)

Add the avifGetSampleCountOfChunk() function for the code that was
duplicated.

Declare the imageCountLimit parameter of
avifCodecDecodeInputGetSamples() to have the uint32_t type (because
decoder->imageCountLimit has the uint32_t type) and replace the uint64_t
variable imageCount with the uint32_t variable imageCountLeft. It is not
necessary to use the uint64_t type in this code.

src/read.c

diff --git a/src/read.c b/src/read.c
index bf50d6a..4ee7627 100644
--- a/src/read.c
+++ b/src/read.c
@@ -329,35 +329,42 @@
     avifFree(decodeInput);
 }
 
+// Returns how many samples are in the chunk.
+static uint32_t avifGetSampleCountOfChunk(const avifSampleTableSampleToChunkArray * sampleToChunks, uint32_t chunkIndex)
+{
+    uint32_t sampleCount = 0;
+    for (int sampleToChunkIndex = sampleToChunks->count - 1; sampleToChunkIndex >= 0; --sampleToChunkIndex) {
+        const avifSampleTableSampleToChunk * sampleToChunk = &sampleToChunks->sampleToChunk[sampleToChunkIndex];
+        if (sampleToChunk->firstChunk <= (chunkIndex + 1)) {
+            sampleCount = sampleToChunk->samplesPerChunk;
+            break;
+        }
+    }
+    return sampleCount;
+}
+
 static avifBool avifCodecDecodeInputGetSamples(avifCodecDecodeInput * decodeInput,
                                                avifSampleTable * sampleTable,
-                                               const uint64_t imageCountLimit,
+                                               const uint32_t imageCountLimit,
                                                const uint64_t sizeHint)
 {
     if (imageCountLimit) {
         // Verify that the we're not about to exceed the frame count limit.
 
-        uint64_t imageCount = 0;
+        uint32_t imageCountLeft = imageCountLimit;
         for (uint32_t chunkIndex = 0; chunkIndex < sampleTable->chunks.count; ++chunkIndex) {
             // First, figure out how many samples are in this chunk
-            uint32_t sampleCount = 0;
-            for (int sampleToChunkIndex = sampleTable->sampleToChunks.count - 1; sampleToChunkIndex >= 0; --sampleToChunkIndex) {
-                avifSampleTableSampleToChunk * sampleToChunk = &sampleTable->sampleToChunks.sampleToChunk[sampleToChunkIndex];
-                if (sampleToChunk->firstChunk <= (chunkIndex + 1)) {
-                    sampleCount = sampleToChunk->samplesPerChunk;
-                    break;
-                }
-            }
+            uint32_t sampleCount = avifGetSampleCountOfChunk(&sampleTable->sampleToChunks, chunkIndex);
             if (sampleCount == 0) {
                 // chunks with 0 samples are invalid
                 return AVIF_FALSE;
             }
 
-            imageCount += sampleCount;
-            if (imageCount > imageCountLimit) {
+            if (sampleCount > imageCountLeft) {
                 // This file exceeds the imageCountLimit, bail out
                 return AVIF_FALSE;
             }
+            imageCountLeft -= sampleCount;
         }
     }
 
@@ -366,14 +373,7 @@
         avifSampleTableChunk * chunk = &sampleTable->chunks.chunk[chunkIndex];
 
         // First, figure out how many samples are in this chunk
-        uint32_t sampleCount = 0;
-        for (int sampleToChunkIndex = sampleTable->sampleToChunks.count - 1; sampleToChunkIndex >= 0; --sampleToChunkIndex) {
-            avifSampleTableSampleToChunk * sampleToChunk = &sampleTable->sampleToChunks.sampleToChunk[sampleToChunkIndex];
-            if (sampleToChunk->firstChunk <= (chunkIndex + 1)) {
-                sampleCount = sampleToChunk->samplesPerChunk;
-                break;
-            }
-        }
+        uint32_t sampleCount = avifGetSampleCountOfChunk(&sampleTable->sampleToChunks, chunkIndex);
         if (sampleCount == 0) {
             // chunks with 0 samples are invalid
             return AVIF_FALSE;