Do not store colorproperties until alpha item is found colorProperties could be pointing to a dangling pointer if findAlphaItem() resizes the meta.items array. Manual cherry-pick of PR #1808 into the chromium-m119 branch.
diff --git a/src/read.c b/src/read.c index 43e9c87..da73c03 100644 --- a/src/read.c +++ b/src/read.c
@@ -4606,7 +4606,6 @@ avifDiagnosticsPrintf(&decoder->diag, "Primary item not found"); return AVIF_RESULT_MISSING_IMAGE_ITEM; } - colorProperties = &colorItem->properties; if (!memcmp(colorItem->type, "grid", 4)) { avifROData readData; AVIF_CHECKRES(avifDecoderItemRead(colorItem, decoder->io, &readData, 0, 0, data->diag)); @@ -4694,6 +4693,8 @@ } #endif // AVIF_ENABLE_EXPERIMENTAL_GAIN_MAP + colorProperties = &colorItem->properties; + // Find Exif and/or XMP metadata, if any AVIF_CHECKRES(avifDecoderFindMetadata(decoder, data->meta, decoder->image, colorItem->id));