Skip to content

Reset Sample Transform state in avifDecoderReset() - #3327

Merged
y-guyon merged 2 commits into
AOMediaCodec:mainfrom
srkyn:fix-sample-transform-decoder-reset
Aug 21, 2026
Merged

y-guyon merged 2 commits into
AOMediaCodec:mainfrom
srkyn:fix-sample-transform-decoder-reset

Conversation

@srkyn

@srkyn srkyn commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

avifDecoderReset() leaves the parsed Sample Transform expression and input count in the decoder data. Calling reset again then adds the inputs a second time. In debug builds this reaches an assertion because the count is expected to start at zero. In release builds the reset returns AVIF_RESULT_INTERNAL_ERROR.

Clear both fields with the rest of the per-parse decoder state. The new test uses the existing weld_sato_12B_8B_q0.avif fixture and covers explicit reset and the reset performed by avifDecoderSetSource().

Tested with the full ASan and UBSan configuration. All 51 tests passed.

Clear the parsed Sample Transform expression and input count before the decode input is rebuilt. Otherwise a second reset, including one performed by avifDecoderSetSource(), encounters stale state and returns AVIF_RESULT_INTERNAL_ERROR, or asserts in debug builds.

Add coverage for direct reset and avifDecoderSetSource().

Signed-off-by: David Sarkisyan <david@srkyn.com>
@wantehchang
wantehchang requested a review from y-guyon August 19, 2026 17:51

@y-guyon y-guyon left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the fix. Could you add it to the CHANGELOG please?

Signed-off-by: David Sarkisyan <david@srkyn.com>
@srkyn

srkyn commented Aug 20, 2026

Copy link
Copy Markdown
Contributor Author

Added the CHANGELOG entry under Unreleased. Thanks!

@y-guyon
y-guyon merged commit f95907a into AOMediaCodec:main Aug 21, 2026
25 checks passed
Comment thread src/read.c
}
avifDecoderDataClearTiles(data);
data->sampleTransformNumInputImageItems = 0;
avifArrayDestroy(&data->meta->sampleTransformExpression);

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suggest we also set data->meta->sampleTransformDepth to an invalid value such as 0.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done in #3333. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants