Bug 1814708 - Error when the length of AVIF color or alpha sequences mismatch. r=tnikkel

Differential Revision: https://phabricator.services.mozilla.com/D168777

image/decoders/nsAVIFDecoder.cpp

@@ -240,7 +240,13 @@ nsAVIFDecoder::DecodeResult AVIFParser::GetImage(AVIFImage& aImage) {
     }
 
     bool hasNext = mColorSampleIter->HasNext();
-    MOZ_ASSERT_IF(mAlphaSampleIter, hasNext == mAlphaSampleIter->HasNext());
+    if (mAlphaSampleIter && (hasNext != mAlphaSampleIter->HasNext())) {
+      MOZ_LOG(
+          sAVIFLog, LogLevel::Warning,
+          ("[this=%p] The %s sequence ends before frame %d, aborting decode.",
+           this, hasNext ? "alpha" : "color", mFrameNum));
+      return AsVariant(nsAVIFDecoder::NonDecoderResult::NoSamples);
+    }
     if (!hasNext) {
       return AsVariant(nsAVIFDecoder::NonDecoderResult::Complete);
     }

image/test/crashtests/crashtests.list

@@ -71,6 +71,7 @@ pref(browser.soft_reload.only_force_validate_top_level_document,false) HTTP load
 load 1765871-1.jpg
 
 load 1814561.avif
+load 1814708.avif
 
 load 1814553.avif