numInputImageItems to avifImageApplyExpression32b#2986
numInputImageItems to avifImageApplyExpression32b#2986wantehchang wants to merge 1 commit intoAOMediaCodec:mainfrom
Conversation
Pass numInputImageItems (the size of the inputImageItems array) to avifImageApplyExpression32b(). Validate the index for the inputImageItems array.
| } else if (token->type == AVIF_SAMPLE_TRANSFORM_INPUT_IMAGE_ITEM_INDEX) { | ||
| const avifImage * image = inputImageItems[token->inputImageItemIndex - 1]; // 1-based | ||
| // inputImageItemIndex is 1-based. | ||
| const uint8_t zeroBasedIndex = token->inputImageItemIndex - 1; |
There was a problem hiding this comment.
There is absolutely no way inputImageItemIndex is 0 I guess?
There was a problem hiding this comment.
Indeed. It is checked in avifSampleTransformExpressionIsValid(), but so is inputImageItemIndex <= numInputImageItems.
There was a problem hiding this comment.
Yannis: The reason I wrote this PR is that it looks bad to pass an array but not the array size to a function. But then the function should use the array size, and the only meaningful way to use the array size in this function is to validate the array index token->inputImageItemIndex.
When I wrote this PR, I didn't analyze the code well enough to see if the caller has already validated token->inputImageItemIndex. Since that is true, this pull request will validate token->inputImageItemIndex redundantly. So I will abandon this pull request.
| } else if (token->type == AVIF_SAMPLE_TRANSFORM_INPUT_IMAGE_ITEM_INDEX) { | ||
| const avifImage * image = inputImageItems[token->inputImageItemIndex - 1]; // 1-based | ||
| // inputImageItemIndex is 1-based. | ||
| const uint8_t zeroBasedIndex = token->inputImageItemIndex - 1; |
There was a problem hiding this comment.
Indeed. It is checked in avifSampleTransformExpressionIsValid(), but so is inputImageItemIndex <= numInputImageItems.
3 participants
Pass numInputImageItems (the size of the inputImageItems array) to avifImageApplyExpression32b(). Validate the index for the inputImageItems array.