Skip to content

Add AVIF plugin (decoder + encoder using libavif) #5201

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 64 commits into from
Apr 1, 2025
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
64 commits
Select commit Hold shift + click to select a range
3878b58
Add AVIF plugin (using libavif)
fdintino Jan 3, 2021
e2add24
Added type hints (#2)
radarhere Oct 16, 2024
e5494a2
Fix PLAT envvar in cibuildwheel container
fdintino Oct 16, 2024
8b8bbba
Update Tests/check_avif_leaks.py
fdintino Oct 18, 2024
58ef692
Simplified code (#3)
radarhere Oct 19, 2024
d6a0a15
Merge branch 'main' into libavif-plugin
radarhere Nov 8, 2024
50b993a
Set default max threads in Python (#4)
radarhere Nov 11, 2024
671e3c8
Removed unused upsampling setting (#5)
radarhere Nov 12, 2024
658cdf3
Merge branch 'main' into libavif-plugin
radarhere Nov 18, 2024
7225cb9
Merge branch 'main' into libavif-plugin
radarhere Nov 24, 2024
3730bf2
Merge branch 'main' into libavif-plugin
radarhere Nov 30, 2024
c40bcbf
Improved error handling
radarhere Dec 2, 2024
d76ae2f
Do not ignore SyntaxError when saving EXIF data (#8)
radarhere Dec 7, 2024
9ad8311
Allow libavif to install rav1e, except on manylinux2014 and aarch64 (#7)
radarhere Dec 7, 2024
de4c6c1
Removed ld64 flag (#6)
radarhere Dec 7, 2024
524d802
fix: set exif orientation from irot/imir when decoding AVIF
fdintino Dec 9, 2024
7b73d77
Merge branch 'main' into libavif-plugin
radarhere Dec 13, 2024
a56acd8
Removed unittest mock (#10)
radarhere Dec 13, 2024
f5dc957
Use cmds_cmake (#9)
radarhere Dec 13, 2024
8d77678
chore(docs): update quality and speed with correct defaults
fdintino Dec 13, 2024
4eaa6b7
Merge branch 'main' into libavif-plugin
radarhere Dec 14, 2024
bdb24f9
Removed `_avif.HAVE_AVIF` and `_avif.VERSION` (#11)
radarhere Dec 15, 2024
ddc8e7e
Use "rav1e" if available as default ("auto") avif encoder
fdintino Dec 15, 2024
b585f9e
Simplified EXIF code (#12)
radarhere Dec 15, 2024
da2e18d
Revert "Use "rav1e" if available as default ("auto") avif encoder"
fdintino Dec 17, 2024
9b6e575
Merge branch 'main' into libavif-plugin
radarhere Dec 18, 2024
3a9a3ab
Reduced epsilons (#13)
radarhere Dec 24, 2024
9328932
Removed avifEncOptions (#14)
radarhere Jan 3, 2025
be02830
Merge branch 'main' into libavif-plugin
radarhere Jan 3, 2025
4135664
Merge branch 'main' into libavif-plugin
radarhere Jan 4, 2025
29c158d
Merge branch 'main' into libavif-plugin
radarhere Jan 8, 2025
4c63ea6
Fixed series of tuples as advanced argument (#15)
radarhere Jan 15, 2025
ce6bf21
Merge branch 'main' into libavif-plugin
radarhere Jan 17, 2025
4b29af4
Skip building libavif on 32-bit Windows (#16)
radarhere Jan 21, 2025
38f0d10
Merge branch 'main' into libavif-plugin
radarhere Jan 25, 2025
1410d23
Removed qmin and qmax (#17)
radarhere Jan 25, 2025
6cbad27
Merge branch 'main' into libavif-plugin
radarhere Feb 1, 2025
19ba2dd
Use rgb.rowBytes in overflow check (#18)
radarhere Feb 3, 2025
4508f37
Use aom LICENSE instead of PATENTS (#19)
radarhere Feb 3, 2025
7de1212
Merge branch 'main' into libavif-plugin
radarhere Feb 7, 2025
e1509ee
Removed memset and ignoreAlpha (#20)
radarhere Feb 9, 2025
0590f08
Handle avifDecoderCreate and avifEncoderCreate errors (#21)
radarhere Feb 12, 2025
5761b44
Merge branch 'main' into libavif-plugin
radarhere Feb 14, 2025
38b9941
Sort formats alphabetically
radarhere Feb 15, 2025
10dfa63
Simplified code
radarhere Feb 15, 2025
9abfdbc
Merge branch 'main' into libavif-plugin
radarhere Mar 3, 2025
d80ac3c
Use default PyTypeObject values
radarhere Feb 8, 2025
b4eec64
Merge branch 'main' into libavif-plugin
radarhere Mar 17, 2025
d552087
Updated libavif to 1.2.1 (#26)
radarhere Mar 17, 2025
79f7339
Updated wording
radarhere Mar 19, 2025
46f4508
Added version comments
radarhere Mar 19, 2025
9bebf37
Sort alphabetically
radarhere Mar 19, 2025
5da2113
Simplified code
radarhere Mar 19, 2025
0732554
Merge branch 'main' into libavif-plugin
radarhere Mar 21, 2025
9ea5e3d
Remove support for libavif < 1.0.0
radarhere Mar 21, 2025
fca6df2
Added get_codec_version() (#29)
radarhere Mar 21, 2025
024a894
Merge branch 'radarhere-avif_1' into libavif-plugin
fdintino Mar 21, 2025
2ba9356
Update rust (#33)
radarhere Mar 25, 2025
fdc68e6
Merge branch 'main' into libavif-plugin
radarhere Mar 31, 2025
9e63868
Continue to build libyuv on macOS
radarhere Mar 31, 2025
eff2680
Added release notes
radarhere Mar 31, 2025
fb096e1
Derive some avif test images from existing Pillow test images
fdintino Mar 31, 2025
1276543
Updated size
radarhere Mar 31, 2025
c8d0408
Continue to build libyuv on Linux
radarhere Mar 31, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Removed memset and ignoreAlpha (#20)
  • Loading branch information
radarhere authored Feb 9, 2025
commit e1509ee88b1cc1bc126b3e2530db8cabdaf956f3
28 changes: 12 additions & 16 deletions src/PIL/AvifImagePlugin.py
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@
# Decoder options as module globals, until there is a way to pass parameters
# to Image.open (see https://github.com/python-pillow/Pillow/issues/569)
DECODE_CODEC_CHOICE = "auto"
# Decoding is only affected by this for libavif **0.8.4** or greater.
DEFAULT_MAX_THREADS = 0


Expand Down Expand Up @@ -47,9 +48,9 @@

def _get_default_max_threads() -> int:
if DEFAULT_MAX_THREADS:
return DEFAULT_MAX_THREADS

Check warning on line 51 in src/PIL/AvifImagePlugin.py

View check run for this annotation

Codecov / codecov/patch

src/PIL/AvifImagePlugin.py#L51

Added line #L51 was not covered by tests
if hasattr(os, "sched_getaffinity"):
return len(os.sched_getaffinity(0))

Check warning on line 53 in src/PIL/AvifImagePlugin.py

View check run for this annotation

Codecov / codecov/patch

src/PIL/AvifImagePlugin.py#L53

Added line #L53 was not covered by tests
else:
return os.cpu_count() or 1

Expand All @@ -61,10 +62,7 @@

def _open(self) -> None:
if not SUPPORTED:
msg = (
"image file could not be identified because AVIF "
"support not installed"
)
msg = "image file could not be opened because AVIF support not installed"
raise SyntaxError(msg)

if DECODE_CODEC_CHOICE != "auto" and not _avif.decoder_codec_available(
Expand Down Expand Up @@ -116,11 +114,11 @@
def load(self) -> Image.core.PixelAccess | None:
if self.tile:
# We need to load the image data for this frame
data, timescale, tsp_in_ts, dur_in_ts = self._decoder.get_frame(
self.__frame
data, timescale, pts_in_timescales, dur_in_timescales = (
self._decoder.get_frame(self.__frame)
)
self.info["timestamp"] = round(1000 * (tsp_in_ts / timescale))
self.info["duration"] = round(1000 * (dur_in_ts / timescale))
self.info["timestamp"] = round(1000 * (pts_in_timescales / timescale))
self.info["duration"] = round(1000 * (dur_in_timescales / timescale))

# Set tile
if self.fp and self._exclusive_fp:
Expand Down Expand Up @@ -212,8 +210,7 @@

# Setup the AVIF encoder
enc = _avif.AvifEncoder(
im.size[0],
im.size[1],
im.size,
subsampling,
quality,
speed,
Expand All @@ -233,7 +230,7 @@

# Add each frame
frame_idx = 0
frame_dur = 0
frame_duration = 0
cur_idx = im.tell()
try:
for ims in [im] + append_images:
Expand All @@ -252,16 +249,15 @@

# Update frame duration
if isinstance(duration, (list, tuple)):
frame_dur = duration[frame_idx]
frame_duration = duration[frame_idx]
else:
frame_dur = duration
frame_duration = duration

# Append the frame to the animation encoder
enc.add(
frame.tobytes("raw", rawmode),
frame_dur,
frame.size[0],
frame.size[1],
frame_duration,
frame.size,
rawmode,
is_single_frame,
)
Expand Down
48 changes: 18 additions & 30 deletions src/_avif.c
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
typedef struct {
PyObject_HEAD avifEncoder *encoder;
avifImage *image;
int frame_index;
int first_frame;
} AvifEncoderObject;

static PyTypeObject AvifEncoder_Type;
Expand All @@ -16,7 +16,6 @@
typedef struct {
PyObject_HEAD avifDecoder *decoder;
Py_buffer buffer;
char *mode;
} AvifDecoderObject;

static PyTypeObject AvifDecoder_Type;
Expand All @@ -37,9 +36,9 @@
static int
normalize_tiles_log2(int value) {
if (value < 0) {
return 0;

Check warning on line 39 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L39

Added line #L39 was not covered by tests
} else if (value > 6) {
return 6;

Check warning on line 41 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L41

Added line #L41 was not covered by tests
} else {
return value;
}
Expand All @@ -56,8 +55,8 @@
case AVIF_RESULT_TRUNCATED_DATA:
case AVIF_RESULT_NO_CONTENT:
return PyExc_SyntaxError;
default:
return PyExc_RuntimeError;

Check warning on line 59 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L58-L59

Added lines #L58 - L59 were not covered by tests
}
}

Expand All @@ -78,15 +77,15 @@
return axis ? 7 // 90 degrees anti-clockwise then swap left and right.
: 5; // 90 degrees anti-clockwise then swap top and bottom.
}
return 6; // 90 degrees anti-clockwise.

Check warning on line 80 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L80

Added line #L80 was not covered by tests
}
if (angle == 2) {
if (imir) {
return axis

Check warning on line 84 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L84

Added line #L84 was not covered by tests
? 4 // 180 degrees anti-clockwise then swap left and right.
: 2; // 180 degrees anti-clockwise then swap top and bottom.

Check warning on line 86 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L86

Added line #L86 was not covered by tests
}
return 3; // 180 degrees anti-clockwise.

Check warning on line 88 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L88

Added line #L88 was not covered by tests
}
if (angle == 3) {
if (imir) {
Expand All @@ -94,7 +93,7 @@
? 5 // 270 degrees anti-clockwise then swap left and right.
: 7; // 270 degrees anti-clockwise then swap top and bottom.
}
return 8; // 270 degrees anti-clockwise.

Check warning on line 96 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L96

Added line #L96 was not covered by tests
}
}
if (imir) {
Expand All @@ -119,11 +118,11 @@
image->imir.mode = 1;
#endif
break;
case 3: // The 0th row is at the visual bottom of the image, and the 0th column

Check warning on line 121 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L121

Added line #L121 was not covered by tests
// is the visual right-hand side.
image->transformFlags |= AVIF_TRANSFORM_IROT;
image->irot.angle = 2;
break;

Check warning on line 125 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L123-L125

Added lines #L123 - L125 were not covered by tests
case 4: // The 0th row is at the visual bottom of the image, and the 0th column
// is the visual left-hand side.
image->transformFlags |= AVIF_TRANSFORM_IMIR;
Expand All @@ -134,27 +133,27 @@
image->irot.angle = 1; // applied before imir according to MIAF spec
// ISO/IEC 28002-12:2021 - section 7.3.6.7
break;
case 6: // The 0th row is the visual right-hand side of the image, and the 0th

Check warning on line 136 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L136

Added line #L136 was not covered by tests
// column is the visual top.
image->transformFlags |= AVIF_TRANSFORM_IROT;
image->irot.angle = 3;
break;

Check warning on line 140 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L138-L140

Added lines #L138 - L140 were not covered by tests
case 7: // The 0th row is the visual right-hand side of the image, and the 0th
// column is the visual bottom.
image->transformFlags |= AVIF_TRANSFORM_IROT | AVIF_TRANSFORM_IMIR;
image->irot.angle = 3; // applied before imir according to MIAF spec
// ISO/IEC 28002-12:2021 - section 7.3.6.7
break;
case 8: // The 0th row is the visual left-hand side of the image, and the 0th

Check warning on line 147 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L147

Added line #L147 was not covered by tests
// column is the visual bottom.
image->transformFlags |= AVIF_TRANSFORM_IROT;
image->irot.angle = 1;
break;

Check warning on line 151 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L149-L151

Added lines #L149 - L151 were not covered by tests
}
}

static int
_codec_available(const char *name, uint32_t flags) {
_codec_available(const char *name, avifCodecFlags flags) {
avifCodecChoice codec = avifCodecChoiceFromName(name);
if (codec == AVIF_CODEC_CHOICE_AUTO) {
return 0;
Expand Down Expand Up @@ -188,38 +187,38 @@
Py_ssize_t i, size;
PyObject *keyval, *py_key, *py_val;
if (!PyTuple_Check(opts)) {
PyErr_SetString(PyExc_ValueError, "Invalid advanced codec options");
return 1;

Check warning on line 191 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L190-L191

Added lines #L190 - L191 were not covered by tests
}
size = PyTuple_GET_SIZE(opts);

for (i = 0; i < size; i++) {
keyval = PyTuple_GetItem(opts, i);
if (!PyTuple_Check(keyval) || PyTuple_GET_SIZE(keyval) != 2) {
PyErr_SetString(PyExc_ValueError, "Invalid advanced codec options");
return 1;

Check warning on line 199 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L198-L199

Added lines #L198 - L199 were not covered by tests
}
py_key = PyTuple_GetItem(keyval, 0);
py_val = PyTuple_GetItem(keyval, 1);
if (!PyUnicode_Check(py_key) || !PyUnicode_Check(py_val)) {
PyErr_SetString(PyExc_ValueError, "Invalid advanced codec options");
return 1;

Check warning on line 205 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L204-L205

Added lines #L204 - L205 were not covered by tests
}
const char *key = PyUnicode_AsUTF8(py_key);
const char *val = PyUnicode_AsUTF8(py_val);
if (key == NULL || val == NULL) {
PyErr_SetString(PyExc_ValueError, "Invalid advanced codec options");
return 1;

Check warning on line 211 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L210-L211

Added lines #L210 - L211 were not covered by tests
}

avifResult result = avifEncoderSetCodecSpecificOption(encoder, key, val);
if (result != AVIF_RESULT_OK) {
PyErr_Format(
exc_type_for_avif_result(result),

Check warning on line 217 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L216-L217

Added lines #L216 - L217 were not covered by tests
"Setting advanced codec options failed: %s",
avifResultToString(result)

Check warning on line 219 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L219

Added line #L219 was not covered by tests
);
return 1;

Check warning on line 221 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L221

Added line #L221 was not covered by tests
}
}
return 0;
Expand Down Expand Up @@ -252,7 +251,7 @@

if (!PyArg_ParseTuple(
args,
"IIsiiissiiOOy*y*iy*O",
"(II)siiissiiOOy*y*iy*O",
&width,
&height,
&subsampling,
Expand Down Expand Up @@ -303,9 +302,9 @@

// Validate canvas dimensions
if (width <= 0 || height <= 0) {
PyErr_SetString(PyExc_ValueError, "invalid canvas dimensions");
avifImageDestroy(image);
return NULL;

Check warning on line 307 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L305-L307

Added lines #L305 - L307 were not covered by tests
}
image->width = width;
image->height = height;
Expand Down Expand Up @@ -351,9 +350,9 @@
if (advanced != Py_None) {
#if AVIF_VERSION >= 80200
if (_add_codec_specific_options(encoder, advanced)) {
avifImageDestroy(image);
avifEncoderDestroy(encoder);
return NULL;

Check warning on line 355 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L353-L355

Added lines #L353 - L355 were not covered by tests
}
#else
PyErr_SetString(
Expand All @@ -367,29 +366,29 @@

self = PyObject_New(AvifEncoderObject, &AvifEncoder_Type);
if (!self) {
PyErr_SetString(PyExc_RuntimeError, "could not create encoder object");
avifImageDestroy(image);
avifEncoderDestroy(encoder);
return NULL;

Check warning on line 372 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L369-L372

Added lines #L369 - L372 were not covered by tests
}
self->frame_index = -1;
self->first_frame = 1;

avifResult result;
if (icc_buffer.len) {
result = avifImageSetProfileICC(image, icc_buffer.buf, icc_buffer.len);
if (result != AVIF_RESULT_OK) {
PyErr_Format(
exc_type_for_avif_result(result),

Check warning on line 381 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L380-L381

Added lines #L380 - L381 were not covered by tests
"Setting ICC profile failed: %s",
avifResultToString(result)

Check warning on line 383 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L383

Added line #L383 was not covered by tests
);
avifImageDestroy(image);
avifEncoderDestroy(encoder);
PyBuffer_Release(&icc_buffer);
PyBuffer_Release(&exif_buffer);
PyBuffer_Release(&xmp_buffer);
PyObject_Del(self);
return NULL;

Check warning on line 391 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L385-L391

Added lines #L385 - L391 were not covered by tests
}
// colorPrimaries and transferCharacteristics are ignored when an ICC
// profile is present, so set them to UNSPECIFIED.
Expand All @@ -405,17 +404,17 @@
if (exif_buffer.len) {
result = avifImageSetMetadataExif(image, exif_buffer.buf, exif_buffer.len);
if (result != AVIF_RESULT_OK) {
PyErr_Format(
exc_type_for_avif_result(result),

Check warning on line 408 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L407-L408

Added lines #L407 - L408 were not covered by tests
"Setting EXIF data failed: %s",
avifResultToString(result)

Check warning on line 410 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L410

Added line #L410 was not covered by tests
);
avifImageDestroy(image);
avifEncoderDestroy(encoder);
PyBuffer_Release(&exif_buffer);
PyBuffer_Release(&xmp_buffer);
PyObject_Del(self);
return NULL;

Check warning on line 417 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L412-L417

Added lines #L412 - L417 were not covered by tests
}
}
PyBuffer_Release(&exif_buffer);
Expand All @@ -423,16 +422,16 @@
if (xmp_buffer.len) {
result = avifImageSetMetadataXMP(image, xmp_buffer.buf, xmp_buffer.len);
if (result != AVIF_RESULT_OK) {
PyErr_Format(
exc_type_for_avif_result(result),

Check warning on line 426 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L425-L426

Added lines #L425 - L426 were not covered by tests
"Setting XMP data failed: %s",
avifResultToString(result)

Check warning on line 428 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L428

Added line #L428 was not covered by tests
);
avifImageDestroy(image);
avifEncoderDestroy(encoder);
PyBuffer_Release(&xmp_buffer);
PyObject_Del(self);
return NULL;

Check warning on line 434 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L430-L434

Added lines #L430 - L434 were not covered by tests
}
}
PyBuffer_Release(&xmp_buffer);
Expand Down Expand Up @@ -466,10 +465,9 @@
unsigned int width;
unsigned int height;
char *mode;
PyObject *is_single_frame = NULL;
unsigned int is_single_frame;
PyObject *ret = Py_None;

int is_first_frame;
avifRGBImage rgb;
avifResult result;

Expand All @@ -479,7 +477,7 @@

if (!PyArg_ParseTuple(
args,
"z#IIIsO",
"y#I(II)sp",
(char **)&rgb_bytes,
&size,
&duration,
Expand All @@ -488,11 +486,9 @@
&mode,
&is_single_frame
)) {
return NULL;

Check warning on line 489 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L489

Added line #L489 was not covered by tests
}

is_first_frame = self->frame_index == -1;

if (image->width != width || image->height != height) {
PyErr_Format(
PyExc_ValueError,
Expand All @@ -505,7 +501,7 @@
return NULL;
}

if (is_first_frame) {
if (self->first_frame) {
// If we don't have an image populated with yuv planes, this is the first frame
frame = image;
} else {
Expand Down Expand Up @@ -538,25 +534,25 @@

result = avifRGBImageAllocatePixels(&rgb);
if (result != AVIF_RESULT_OK) {
PyErr_Format(
exc_type_for_avif_result(result),

Check warning on line 538 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L537-L538

Added lines #L537 - L538 were not covered by tests
"Pixel allocation failed: %s",
avifResultToString(result)

Check warning on line 540 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L540

Added line #L540 was not covered by tests
);
return NULL;

Check warning on line 542 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L542

Added line #L542 was not covered by tests
}

if (rgb.rowBytes * rgb.height != size) {
PyErr_Format(
PyExc_RuntimeError,

Check warning on line 547 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L546-L547

Added lines #L546 - L547 were not covered by tests
"rgb data is incorrect size: %u * %u (%u) != %u",
rgb.rowBytes,
rgb.height,
rgb.rowBytes * rgb.height,
size

Check warning on line 552 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L549-L552

Added lines #L549 - L552 were not covered by tests
);
ret = NULL;
goto end;

Check warning on line 555 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L554-L555

Added lines #L554 - L555 were not covered by tests
}

// rgb.pixels is safe for writes
Expand All @@ -567,17 +563,17 @@
Py_END_ALLOW_THREADS;

if (result != AVIF_RESULT_OK) {
PyErr_Format(
exc_type_for_avif_result(result),

Check warning on line 567 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L566-L567

Added lines #L566 - L567 were not covered by tests
"Conversion to YUV failed: %s",
avifResultToString(result)

Check warning on line 569 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L569

Added line #L569 was not covered by tests
);
ret = NULL;
goto end;

Check warning on line 572 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L571-L572

Added lines #L571 - L572 were not covered by tests
}

uint32_t addImageFlags = AVIF_ADD_IMAGE_FLAG_NONE;
if (PyObject_IsTrue(is_single_frame)) {
if (is_single_frame) {
addImageFlags |= AVIF_ADD_IMAGE_FLAG_SINGLE;
}

Expand All @@ -597,12 +593,12 @@

end:
avifRGBImageFreePixels(&rgb);
if (!is_first_frame) {
if (!self->first_frame) {
avifImageDestroy(frame);
}

if (ret == Py_None) {
self->frame_index++;
self->first_frame = 0;
Py_RETURN_NONE;
} else {
return ret;
Expand All @@ -622,13 +618,13 @@
Py_END_ALLOW_THREADS;

if (result != AVIF_RESULT_OK) {
PyErr_Format(
exc_type_for_avif_result(result),

Check warning on line 622 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L621-L622

Added lines #L621 - L622 were not covered by tests
"Failed to finish encoding: %s",
avifResultToString(result)

Check warning on line 624 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L624

Added line #L624 was not covered by tests
);
avifRWDataFree(&raw);
return NULL;

Check warning on line 627 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L626-L627

Added lines #L626 - L627 were not covered by tests
}

ret = PyBytes_FromStringAndSize((char *)raw.data, raw.size);
Expand Down Expand Up @@ -663,9 +659,9 @@

self = PyObject_New(AvifDecoderObject, &AvifDecoder_Type);
if (!self) {
PyErr_SetString(PyExc_RuntimeError, "could not create decoder object");
PyBuffer_Release(&buffer);
return NULL;

Check warning on line 664 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L662-L664

Added lines #L662 - L664 were not covered by tests
}

decoder = avifDecoderCreate();
Expand All @@ -684,15 +680,15 @@

result = avifDecoderSetIOMemory(decoder, buffer.buf, buffer.len);
if (result != AVIF_RESULT_OK) {
PyErr_Format(
exc_type_for_avif_result(result),

Check warning on line 684 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L683-L684

Added lines #L683 - L684 were not covered by tests
"Setting IO memory failed: %s",
avifResultToString(result)

Check warning on line 686 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L686

Added line #L686 was not covered by tests
);
avifDecoderDestroy(decoder);
PyBuffer_Release(&buffer);
PyObject_Del(self);
return NULL;

Check warning on line 691 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L688-L691

Added lines #L688 - L691 were not covered by tests
}

result = avifDecoderParse(decoder);
Expand All @@ -708,12 +704,6 @@
return NULL;
}

if (decoder->alphaPresent) {
self->mode = "RGBA";
} else {
self->mode = "RGB";
}

self->decoder = decoder;
self->buffer = buffer;

Expand Down Expand Up @@ -757,7 +747,7 @@
image->width,
image->height,
decoder->imageCount,
self->mode,
decoder->alphaPresent == AVIF_TRUE ? "RGBA" : "RGB",
NULL == icc ? Py_None : icc,
NULL == exif ? Py_None : exif,
irot_imir_to_exif_orientation(image),
Expand Down Expand Up @@ -785,42 +775,36 @@
decoder = self->decoder;

if (!PyArg_ParseTuple(args, "I", &frame_index)) {
return NULL;

Check warning on line 778 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L778

Added line #L778 was not covered by tests
}

result = avifDecoderNthImage(decoder, frame_index);
if (result != AVIF_RESULT_OK) {
PyErr_Format(
exc_type_for_avif_result(result),

Check warning on line 784 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L783-L784

Added lines #L783 - L784 were not covered by tests
"Failed to decode frame %u: %s",
decoder->imageIndex + 1,
frame_index,
avifResultToString(result)

Check warning on line 787 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L786-L787

Added lines #L786 - L787 were not covered by tests
);
return NULL;

Check warning on line 789 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L789

Added line #L789 was not covered by tests
}

image = decoder->image;

memset(&rgb, 0, sizeof(rgb));
avifRGBImageSetDefaults(&rgb, image);

rgb.depth = 8;

if (decoder->alphaPresent) {
rgb.format = AVIF_RGB_FORMAT_RGBA;
} else {
rgb.format = AVIF_RGB_FORMAT_RGB;
rgb.ignoreAlpha = AVIF_TRUE;
}
rgb.format =
decoder->alphaPresent == AVIF_TRUE ? AVIF_RGB_FORMAT_RGBA : AVIF_RGB_FORMAT_RGB;

result = avifRGBImageAllocatePixels(&rgb);
if (result != AVIF_RESULT_OK) {
PyErr_Format(
exc_type_for_avif_result(result),

Check warning on line 803 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L802-L803

Added lines #L802 - L803 were not covered by tests
"Pixel allocation failed: %s",
avifResultToString(result)

Check warning on line 805 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L805

Added line #L805 was not covered by tests
);
return NULL;

Check warning on line 807 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L807

Added line #L807 was not covered by tests
}

Py_BEGIN_ALLOW_THREADS;
Expand All @@ -828,18 +812,18 @@
Py_END_ALLOW_THREADS;

if (result != AVIF_RESULT_OK) {
PyErr_Format(
exc_type_for_avif_result(result),

Check warning on line 816 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L815-L816

Added lines #L815 - L816 were not covered by tests
"Conversion from YUV failed: %s",
avifResultToString(result)

Check warning on line 818 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L818

Added line #L818 was not covered by tests
);
avifRGBImageFreePixels(&rgb);
return NULL;

Check warning on line 821 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L820-L821

Added lines #L820 - L821 were not covered by tests
}

if (rgb.height > PY_SSIZE_T_MAX / rgb.rowBytes) {
PyErr_SetString(PyExc_MemoryError, "Integer overflow in pixel size");
return NULL;

Check warning on line 826 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L825-L826

Added lines #L825 - L826 were not covered by tests
}

size = rgb.rowBytes * rgb.height;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this guaranteed to not overflow, even in the face of invalid input?

Copy link
Contributor Author

@fdintino fdintino Jan 12, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

libavif currently restricts images to a maximum of 2^28 pixels. If the dimensions are larger than 16384x16384 then the function that sets decoder->image->width and decoder->image->height fails. So I suppose that a 4-channel 16384x16384 8-bit image could overflow on a 32-bit platform. I'm not certain because the codecs used by libavif have their own overflow limit checks. For instance, dav1d enforces a maximum of 2^26 pixels on 32-bit systems. Should I add a check against PY_SSIZE_T_MAX to be sure? (edit: answering my own question and adding this check)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added here

Pillow/src/_avif.c

Lines 619 to 622 in b84a8e0

if (rgb.height > PY_SSIZE_T_MAX / row_bytes) {
PyErr_SetString(PyExc_MemoryError, "Integer overflow in pixel size");
return NULL;
}

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Basically, I'm the one who will get a CVE on this if there's a problem, and I'd like really clear guidelines about what the assumptions are for sizes of things and where they come from for dangerous operations like memset, malloc, and pointer reads/writes. This isn't so much for now, but a couple years down the line, things need to be clear. This will be fuzzed, this will be run under valgrind, so hopefully there won't be problems.

I've basically had to reverse engineer how SgiRleDecode works over the last month or so, and I'd like to be preventing that sort of experience in the future.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does raising a MemoryError if rgb.height > PY_SSIZE_T_MAX / row_bytes (as I have in the latest PR push) suffice to address that concern?

Expand Down Expand Up @@ -912,7 +896,7 @@
static int
setup_module(PyObject *m) {
if (PyType_Ready(&AvifDecoder_Type) < 0 || PyType_Ready(&AvifEncoder_Type) < 0) {
return -1;

Check warning on line 899 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L899

Added line #L899 was not covered by tests
}

PyObject *d = PyModule_GetDict(m);
Expand All @@ -936,9 +920,13 @@

m = PyModule_Create(&module_def);
if (setup_module(m) < 0) {
Py_DECREF(m);
return NULL;

Check warning on line 924 in src/_avif.c

View check run for this annotation

Codecov / codecov/patch

src/_avif.c#L923-L924

Added lines #L923 - L924 were not covered by tests
}

#ifdef Py_GIL_DISABLED
PyUnstable_Module_SetGIL(m, Py_MOD_GIL_NOT_USED);
#endif

return m;
}
Loading