Commit 66fcddb39f for aom

commit 66fcddb39f8236659e5a9182bdf80151696c76c0
Author: James Zern <jzern@google.com>
Date:   Mon Mar 16 16:27:39 2026 -0700

    aom_image,img_alloc_helper: verify aom_img_fmt_t

    Explicitly check for known values rather than just failing when the
    format is equal to `AOM_IMG_FMT_NONE`.

    Ported from libvpx:
      d51fafc08 vpx_image,img_alloc_helper: verify vpx_img_fmt_t

    Change-Id: Iae9715dc0ca7de8484b14f538ae567aace96bfe3

diff --git a/aom/src/aom_image.c b/aom/src/aom_image.c
index 3522cdaa0a..fa3ab06de1 100644
--- a/aom/src/aom_image.c
+++ b/aom/src/aom_image.c
@@ -11,6 +11,7 @@

 #include <assert.h>
 #include <limits.h>
+#include <stdbool.h>
 #include <stdlib.h>
 #include <string.h>

@@ -30,6 +31,23 @@ static inline unsigned int align_image_dimension(unsigned int d,
   return ((d + align) & ~align);
 }

+static bool is_valid_img_fmt(aom_img_fmt_t fmt) {
+  switch (fmt) {
+    case AOM_IMG_FMT_YV12:
+    case AOM_IMG_FMT_I420:
+    case AOM_IMG_FMT_AOMYV12:
+    case AOM_IMG_FMT_AOMI420:
+    case AOM_IMG_FMT_I422:
+    case AOM_IMG_FMT_I444:
+    case AOM_IMG_FMT_NV12:
+    case AOM_IMG_FMT_I42016:
+    case AOM_IMG_FMT_YV1216:
+    case AOM_IMG_FMT_I42216:
+    case AOM_IMG_FMT_I44416: return true;
+    default: return false;
+  }
+}
+
 static aom_image_t *img_alloc_helper(
     aom_image_t *img, aom_img_fmt_t fmt, unsigned int d_w, unsigned int d_h,
     unsigned int buf_align, unsigned int stride_align, unsigned int size_align,
@@ -42,7 +60,7 @@ static aom_image_t *img_alloc_helper(

   if (img != NULL) memset(img, 0, sizeof(aom_image_t));

-  if (fmt == AOM_IMG_FMT_NONE) goto fail;
+  if (!is_valid_img_fmt(fmt)) goto fail;

   /* Impose maximum values on input parameters so that this function can
    * perform arithmetic operations without worrying about overflows.
diff --git a/test/aom_image_test.cc b/test/aom_image_test.cc
index 5976061fa9..f47d780207 100644
--- a/test/aom_image_test.cc
+++ b/test/aom_image_test.cc
@@ -9,6 +9,7 @@
  * PATENTS file, you can obtain it at www.aomedia.org/license/patent.
  */

+#include <array>
 #include <climits>

 #include "aom/aom_image.h"
@@ -49,14 +50,18 @@ TEST(AomImageTest, AomImgSetRectOverflow) {
             0);
 }

-TEST(AomImageTest, AomImgAllocNone) {
-  const int kWidth = 128;
-  const int kHeight = 128;
-
-  aom_image_t img;
-  aom_img_fmt_t format = AOM_IMG_FMT_NONE;
-  unsigned int align = 32;
-  ASSERT_EQ(aom_img_alloc(&img, format, kWidth, kHeight, align), nullptr);
+TEST(AomImageTest, AomImgAllocInvalidImageFormats) {
+  static constexpr std::array<int, 5> kImageFormats = {
+    AOM_IMG_FMT_NONE, AOM_IMG_FMT_NONE - 1, AOM_IMG_FMT_NV12 + 1,
+    AOM_IMG_FMT_I42016 - 1, AOM_IMG_FMT_I44416 + 1
+  };
+
+  for (const auto img_fmt : kImageFormats) {
+    EXPECT_EQ(
+        aom_img_alloc(/*img=*/nullptr, static_cast<aom_img_fmt_t>(img_fmt),
+                      /*d_w=*/32, /*d_h=*/32, /*align=*/1),
+        nullptr);
+  }
 }

 TEST(AomImageTest, AomImgAllocNv12) {