commit 1a78d970b8315e7cc6a8601861ec75189c50c214
author Vignesh Venkatasubramanian <vigneshv@google.com> Mon Nov 27 11:31:38 2023 -0800
committer Vignesh Venkatasubramanian <vigneshv@google.com> Tue Nov 28 15:23:54 2023 -0800
tree a04377901e8f3b0df1e5bf658e64f410c135ba8a
parent 466d5e5f8889053115d445637ab8f6e0b3c70ed3

Do not store colorproperties until alpha item is found

colorProperties could be pointing to a dangling pointer if
findAlphaItem() resizes the meta.items array.

Manual cherry-pick of PR #1808 into the chromium-m120 branch.

src/read.c

diff --git a/src/read.c b/src/read.c
index dc99ee6..47a55ea 100644
--- a/src/read.c
+++ b/src/read.c
@@ -4655,7 +4655,6 @@
                                                   /*isItemInInput=*/AVIF_TRUE,
                                                   &data->tileInfos[AVIF_ITEM_COLOR].grid,
                                                   &codecType[AVIF_ITEM_COLOR]));
-        colorProperties = &data->meta->items.item[mainItemIndices[AVIF_ITEM_COLOR]].properties;
         colorCodecType = codecType[AVIF_ITEM_COLOR];
 
         // Optional alpha auxiliary item
@@ -4713,6 +4712,7 @@
         for (int c = 0; c < AVIF_ITEM_CATEGORY_COUNT; ++c) {
             mainItems[c] = (mainItemIndices[c] == -1) ? NULL : &data->meta->items.item[mainItemIndices[c]];
         }
+        colorProperties = &mainItems[AVIF_ITEM_COLOR]->properties;
 
         // Find Exif and/or XMP metadata, if any
         AVIF_CHECKRES(avifDecoderFindMetadata(decoder, data->meta, decoder->image, mainItems[AVIF_ITEM_COLOR]->id));