Fails with "unsafe precondition(s) violated" since Rust 1.78

[sophie-h]

heif_context_read_from_reader calls triggers

unsafe precondition(s) violated: slice::from_raw_parts_mut requires the pointer to be aligned and non-null, and the total size of the slice not to exceed isize::MAX

I did not call it directly but used HeifContext::read_from_reader. But I guess the issue here is the design of the slice types used?

rust-lang/rust#123285

[Cykooz]

I think that this error is occurred inside the function libheif-rs::reader::read:

unsafe extern "C" fn read(data: *mut c_void, size: usize, user_data: *mut c_void) -> c_int {
    let reader = &mut *(user_data as *mut Box<dyn Reader>);
    let buf = slice::from_raw_parts_mut(data as *mut u8, size);
    match reader.read(buf) {
        Ok(real_size) if real_size == buf.len() => 0,
        _ => 1,
    }
}

It seems like libheif may pass null pointer as the data argument or size that exceed isize::MAX. I will check it.

Could you give me an example of code (and heif-file) to reproduce this error?

[Cykooz]

What architecture were you running the code on when you got this error? Is it 32-bit architecture?

[sophie-h]

Not tested on 32bit but my CI started failing for amd64 and aarch64 when updating to Rust 1.78 and my Desktop (amd64) as well.

[sophie-h]

I will try to create a minimal reproducer later. The original code is a bit involved.

[sophie-h]

pub fn main() {
    let data = std::fs::read("color.avif").unwrap();
    let len = data.len() as u64;
    let stream_reader = libheif_rs::StreamReader::new(std::io::Cursor::new(data), len);

    libheif_rs::HeifContext::read_from_reader(Box::new(stream_reader)).unwrap();
}

It seems to happen with all avif pictures but not heic. For completeness here is an image https://gitlab.gnome.org/sophie-h/test-images/-/blob/main/images/color/color.avif

[Cykooz]

I have checked. libheif calls function read() with data=null and size=0.
I believe that this piece of avif-format parser code causes an error in libheif-rs.

https://github.com/strukturag/libheif/blob/e64bb552f5d48fee5daf69c8c2fd59ec3eee0818/libheif/avif.cc#L73-L78

  const size_t configOBUs_bytes = range.get_remaining_bytes();
  m_config_OBUs.resize(configOBUs_bytes);

  if (!range.read(m_config_OBUs.data(), configOBUs_bytes)) {
    // error
  }

Here range is a C++ wrapper for our StreamReader. If his method get_remaining_bytes() returns zero the m_config_OBUs vector will be resized to empty size. In this case a pointer to vector's data will be null.

I've added the handling of this case into read function and release libheif-rs v1.0.2

[sophie-h]

Thanks a lot!