Skip to content

numInputImageItems to avifImageApplyExpression32b #2986

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wantehchang wants to merge 1 commit into from
Closed

numInputImageItems to avifImageApplyExpression32b #2986

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions src/sampletransform.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -283,6 +283,7 @@ AVIF_ARRAY_DECLARE(avifSampleTransformStack32b, int32_t, elements);

static avifResult avifImageApplyExpression32b(avifImage * dstImage,
const avifSampleTransformExpression * expression,
uint8_t numInputImageItems,
const avifImage * inputImageItems[],
avifPlanesFlags planes,
int32_t * stack,
Expand Down Expand Up @@ -313,7 +314,10 @@ static avifResult avifImageApplyExpression32b(avifImage * dstImage,
AVIF_ASSERT_OR_RETURN(stackSize < stackCapacity);
stack[stackSize++] = token->constant;
} else if (token->type == AVIF_SAMPLE_TRANSFORM_INPUT_IMAGE_ITEM_INDEX) {
const avifImage * image = inputImageItems[token->inputImageItemIndex - 1]; // 1-based
// inputImageItemIndex is 1-based.
const uint8_t zeroBasedIndex = token->inputImageItemIndex - 1;
Copy link
Copy Markdown
Contributor

@vrabaud vrabaud Jan 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is absolutely no way inputImageItemIndex is 0 I guess?

Copy link
Copy Markdown
Contributor

@y-guyon y-guyon Feb 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Indeed. It is checked in avifSampleTransformExpressionIsValid(), but so is inputImageItemIndex <= numInputImageItems.

Copy link
Copy Markdown
Collaborator Author

@wantehchang wantehchang Feb 19, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yannis: The reason I wrote this PR is that it looks bad to pass an array but not the array size to a function. But then the function should use the array size, and the only meaningful way to use the array size in this function is to validate the array index token->inputImageItemIndex.

When I wrote this PR, I didn't analyze the code well enough to see if the caller has already validated token->inputImageItemIndex. Since that is true, this pull request will validate token->inputImageItemIndex redundantly. So I will abandon this pull request.

AVIF_ASSERT_OR_RETURN(zeroBasedIndex < numInputImageItems);
const avifImage * image = inputImageItems[zeroBasedIndex];
const uint8_t * row = avifImagePlane(image, c);
AVIF_ASSERT_OR_RETURN(row != NULL);
row += (size_t)avifImagePlaneRowBytes(image, c) * y;
Expand Down Expand Up @@ -379,7 +383,8 @@ avifResult avifImageApplyExpression(avifImage * dstImage,
uint32_t stackCapacity = expression->count / 2 + 1;
int32_t * stack = avifAlloc(stackCapacity * sizeof(int32_t));
AVIF_CHECKERR(stack != NULL, AVIF_RESULT_OUT_OF_MEMORY);
const avifResult result = avifImageApplyExpression32b(dstImage, expression, inputImageItems, planes, stack, stackCapacity);
const avifResult result =
avifImageApplyExpression32b(dstImage, expression, numInputImageItems, inputImageItems, planes, stack, stackCapacity);
avifFree(stack);
return result;
}
Expand Down
Loading