commit 58bc7b8bb8408ec7eef5f4b3d809e965e92c054b
author Vignesh Venkatasubramanian <vigneshv@google.com> Tue Nov 28 08:44:22 2023 -0800
committer Vignesh Venkatasubramanian <vigneshv@google.com> Tue Nov 28 15:23:11 2023 -0800
tree 8850da2c627f148b2586c5eb2f573de0fa9751ee
parent b2d36b1c3bfc806694cd4ff0cb188270823fe6d8

Do not store colorproperties until alpha item is found

colorProperties could be pointing to a dangling pointer if
findAlphaItem() resizes the meta.items array.

Manual cherry-pick of PR #1808 into the chromium-m118 branch.

src/read.c

diff --git a/src/read.c b/src/read.c
index e3bad98..cf9f2a7 100644
--- a/src/read.c
+++ b/src/read.c
@@ -3938,7 +3938,6 @@
             avifDiagnosticsPrintf(&decoder->diag, "Primary item not found");
             return AVIF_RESULT_MISSING_IMAGE_ITEM;
         }
-        colorProperties = &colorItem->properties;
         if (!memcmp(colorItem->type, "grid", 4)) {
             avifROData readData;
             AVIF_CHECKRES(avifDecoderItemRead(colorItem, decoder->io, &readData, 0, 0, data->diag));
@@ -3995,6 +3994,8 @@
             }
         }
 
+        colorProperties = &colorItem->properties;
+
         // Find Exif and/or XMP metadata, if any
         AVIF_CHECKRES(avifDecoderFindMetadata(decoder, data->meta, decoder->image, colorItem->id));