commit d89118766bbb79aaacc23e22a874e300c63c028b
author Wan-Teh Chang <wtc@google.com> Mon Feb 14 14:15:00 2022 -0800
committer Wan-Teh Chang <wtc@google.com> Mon Feb 14 14:57:09 2022 -0800
tree 19903b78ec3334a545301589912c7d313244b2f1
parent a8cd44119112b55f0433025d57a1ca245ec23d7c

Handle avifDecoderDataCreateTile() failures

Allow avifDecoderDataCreateTile() to fail on avifImageCreateEmpty() or
avifCodecDecodeInputCreate() failures. Note that we don't check for
avifArrayPushPtr() failure yet. That will be done later.

Change all avifDecoderDataCreateTile() callers to handle its failures.

Bug: https://github.com/AOMediaCodec/libavif/issues/820

src/read.c

diff --git a/src/read.c b/src/read.c
index 492b7a2..da768ff 100644
--- a/src/read.c
+++ b/src/read.c
@@ -814,11 +814,27 @@
 {
     avifTile * tile = (avifTile *)avifArrayPushPtr(&data->tiles);
     tile->image = avifImageCreateEmpty();
+    if (!tile->image) {
+        goto error;
+    }
     tile->input = avifCodecDecodeInputCreate();
+    if (!tile->input) {
+        goto error;
+    }
     tile->width = width;
     tile->height = height;
     tile->operatingPoint = operatingPoint;
     return tile;
+
+error:
+    if (tile->input) {
+        avifCodecDecodeInputDestroy(tile->input);
+    }
+    if (tile->image) {
+        avifImageDestroy(tile->image);
+    }
+    avifArrayPop(&data->tiles);
+    return NULL;
 }
 
 static avifTrack * avifDecoderDataCreateTrack(avifDecoderData * data)
@@ -1211,6 +1227,9 @@
             }
 
             avifTile * tile = avifDecoderDataCreateTile(decoder->data, item->width, item->height, avifDecoderItemOperatingPoint(item));
+            if (!tile) {
+                return AVIF_FALSE;
+            }
             if (!avifCodecDecodeInputFillFromDecoderItem(tile->input,
                                                          item,
                                                          decoder->allowProgressive,
@@ -3275,6 +3294,9 @@
         }
 
         avifTile * colorTile = avifDecoderDataCreateTile(data, colorTrack->width, colorTrack->height, 0); // No way to set operating point via tracks
+        if (!colorTile) {
+            return AVIF_RESULT_OUT_OF_MEMORY;
+        }
         if (!avifCodecDecodeInputFillFromSampleTable(colorTile->input,
                                                      colorTrack->sampleTable,
                                                      decoder->imageCountLimit,
@@ -3286,6 +3308,9 @@
 
         if (alphaTrack) {
             avifTile * alphaTile = avifDecoderDataCreateTile(data, alphaTrack->width, alphaTrack->height, 0); // No way to set operating point via tracks
+            if (!alphaTile) {
+                return AVIF_RESULT_OUT_OF_MEMORY;
+            }
             if (!avifCodecDecodeInputFillFromSampleTable(alphaTile->input,
                                                          alphaTrack->sampleTable,
                                                          decoder->imageCountLimit,
@@ -3438,6 +3463,9 @@
 
             avifTile * colorTile =
                 avifDecoderDataCreateTile(data, colorItem->width, colorItem->height, avifDecoderItemOperatingPoint(colorItem));
+            if (!colorTile) {
+                return AVIF_RESULT_OUT_OF_MEMORY;
+            }
             if (!avifCodecDecodeInputFillFromDecoderItem(colorTile->input,
                                                          colorItem,
                                                          decoder->allowProgressive,
@@ -3477,6 +3505,9 @@
 
                 avifTile * alphaTile =
                     avifDecoderDataCreateTile(data, alphaItem->width, alphaItem->height, avifDecoderItemOperatingPoint(alphaItem));
+                if (!alphaTile) {
+                    return AVIF_RESULT_OUT_OF_MEMORY;
+                }
                 if (!avifCodecDecodeInputFillFromDecoderItem(alphaTile->input,
                                                              alphaItem,
                                                              decoder->allowProgressive,