AVIF Decoder Error Handling for Corrupted OBUs

When decoding AVIF (AV1 Image File Format) images, bitstream corruption within Open Bitstream Units (OBUs) can cause crashes, visual artifacts, or security vulnerabilities. This article details the standard error-handling procedures an AVIF decoder must implement when encountering malformed or corrupted OBUs, covering parsing validation, critical versus non-critical classification, safe recovery mechanisms, and memory security.

1. Bitstream Validation and Bounds Checking

Before decoding payloads, the decoder must validate the syntactic integrity of the OBU framing.

• Header Verification: Parse the obu_header() to ensure the obu_type is valid according to the AV1 specification and that reserved bits are handled appropriately.
• Size Field Consistency: If obu_has_size_field is set, check whether the declared obu_size exceeds the actual remaining byte length of the container (the ISOBMFF mdat or item payload). If the declared size extends beyond available data, immediately flag an truncation error.
• Trailing Bits Check: Verify that trailing_bits() adhere to the required stop-bit pattern (1 followed by zero or more 0 bits). Failure here strongly indicates bitstream desynchronization.

2. Distinguishing Critical from Non-Critical OBUs

An AVIF decoder must not treat all OBUs equally when errors occur. Instead, it must classify the unit to decide whether to abort or proceed.

• Critical OBUs: Units essential for image reconstruction, such as OBU_SEQUENCE_HEADER and OBU_FRAME_HEADER (or OBU_FRAME). If these contain syntax errors or invalid configuration parameters (e.g., unsupported bit depth, invalid profile, or out-of-bounds dimensions), decoding must be safely terminated, and the decoder must return an invalid bitstream error.
• Non-Critical OBUs: Auxiliary units such as OBU_METADATA (e.g., HDR mastering display metadata, color volume) or unknown/reserved OBU types. If corruption occurs within these units, the decoder should log a warning, discard the unit, and proceed to the next OBU.

3. Safe Skipping via Size Delimitation

When an error is detected in an OBU that is not fatal to the overall decode process:

• Use the obu_size field to advance the read pointer directly past the corrupted payload to the start of the next OBU.
• If obu_has_size_field is not set, the decoder must terminate parsing for that temporal unit because it cannot reliably determine where the current OBU ends and the next begins.

4. Tile-Level Error Concealment

AVIF images often utilize tiling for parallel decoding. If a corruption occurs within an OBU_TILE_GROUP:

• Discard Malformed Tiles: If entropy decoding (using the Daala multi-symbol arithmetic coder) hits an illegal state, isolate the failure to the specific tile.
• Partial Rendering: Depending on the implementation policy, the decoder can either reject the frame entirely or render the intact tiles while filling corrupted tile areas with a solid background color (e.g., neutral gray or transparent black).
• Reference Frame Invalidation: For animated AVIF files (AVIFS), any frame relying on an inter-frame reference that suffered corruption must not be used as a predictor for subsequent frames to prevent error propagation.

5. Security and Memory Safety Controls

Corrupted OBUs are a frequent vector for exploitation. Decoders must enforce strict runtime guards:

• Prevent Allocation Bombs: Never allocate memory based strictly on dimensions declared in an untrusted OBU header without validating those dimensions against the containing AVIF image properties (such as the ispe box in the MP4 container).
• Prevent Buffer Overflows: Ensure arithmetic decoder states are strictly bounded to designated input buffers, immediately trapping any out-of-bounds read or write attempts.
• Integer Overflow Protection: Validate tile size and coordinate offsets during header parsing using checked arithmetic to prevent wrapping vulnerabilities.

6. Deterministic Error Signaling

An AVIF decoder must exit cleanly when corruption prevents successful processing. It should return specific, actionable status codes (such as AVIF_RESULT_BMFF_PARSE_FAILED, AVIF_RESULT_CORRUPTED_DATA, or AVIF_RESULT_DECODE_FRAME_FAILED) rather than failing silently or causing application-level crashes. State machines must be reset to allow the decoder context to be safely reused or destroyed without memory leaks.