We don't always validate all metadata returned by load libraries (we mostly assume they do this).

Perhaps we should add more protection against this type of error? For example, we could add:

if (!vips_object_sanity(VIPS_OBJECT(image)))
    return -1;

Near the start of major functions such as vips_image_generate(), or at strategic points in the base class of VipsForeign.

vips_image_sanity() can be quite slow (it walks the entire pipeline testing inter-image links). We could maybe only do the walk when --vips-leak is enabled.

I added some extra sanity checks as a backstop. They wouldn't have stopped this error, but they should catch other missed validations.

Is this too large a change for stable? We could delay until 8.18.

Should the target branch be updated to 8.17?

Oh drat, I always forget to set the target, sorry.

I'm unsure about adding these new vips_object_sanity calls given it uses printf, which is more of a CLI approach than libvips-as-a-library behaviour.

Oh, you're right, vips_object_sanity() sends stuff to stdout.

It'd be a simple change to make sanity log an error, or perhaps that should wait until 8.18?