From 02b43568757feb4d72baa30425bf924d6513c34f Mon Sep 17 00:00:00 2001
From: Urvang Joshi <urvang@google.com>
Date: Tue, 30 Oct 2012 15:50:47 -0700
Subject: [PATCH] Add NULL check in chunk APIs

Change-Id: I173ff6c9259111762580c1963ff60e34fd1e9b6b
---
 src/mux/muxedit.c | 14 +++++++++-----
 src/mux/muxread.c | 11 +++++++----
 src/webp/mux.h    |  6 +++---
 3 files changed, 19 insertions(+), 12 deletions(-)

diff --git a/src/mux/muxedit.c b/src/mux/muxedit.c
index 4d6999b0..f85500fa 100644
--- a/src/mux/muxedit.c
+++ b/src/mux/muxedit.c
@@ -189,7 +189,7 @@ static WebPMuxError MuxDeleteAllNamedData(WebPMux* const mux, uint32_t tag) {
   const WebPChunkId id = ChunkGetIdFromTag(tag);
   WebPChunk** chunk_list;
 
-  if (mux == NULL) return WEBP_MUX_INVALID_ARGUMENT;
+  assert(mux != NULL);
   if (IsWPI(id)) return WEBP_MUX_INVALID_ARGUMENT;
 
   chunk_list = MuxGetChunkListFromId(mux, id);
@@ -199,6 +199,7 @@ static WebPMuxError MuxDeleteAllNamedData(WebPMux* const mux, uint32_t tag) {
 }
 
 static WebPMuxError DeleteLoopCount(WebPMux* const mux) {
+  if (mux == NULL) return WEBP_MUX_INVALID_ARGUMENT;
   return MuxDeleteAllNamedData(mux, kChunks[IDX_LOOP].tag);
 }
 
@@ -207,13 +208,15 @@ static WebPMuxError DeleteLoopCount(WebPMux* const mux) {
 
 WebPMuxError WebPMuxSetChunk(WebPMux* mux, const char fourcc[4],
                              const WebPData* chunk_data, int copy_data) {
-  const CHUNK_INDEX idx = ChunkGetIndexFromFourCC(fourcc);
-  const uint32_t tag = ChunkGetTagFromFourCC(fourcc);
+  CHUNK_INDEX idx;
+  uint32_t tag;
   WebPMuxError err;
-  if (mux == NULL || chunk_data == NULL || chunk_data->bytes == NULL ||
-      chunk_data->size > MAX_CHUNK_PAYLOAD) {
+  if (mux == NULL || fourcc == NULL || chunk_data == NULL ||
+      chunk_data->bytes == NULL || chunk_data->size > MAX_CHUNK_PAYLOAD) {
     return WEBP_MUX_INVALID_ARGUMENT;
   }
+  idx = ChunkGetIndexFromFourCC(fourcc);
+  tag = ChunkGetTagFromFourCC(fourcc);
 
   // Delete existing chunk(s) with the same 'fourcc'.
   err = MuxDeleteAllNamedData(mux, tag);
@@ -377,6 +380,7 @@ WebPMuxError WebPMuxSetLoopCount(WebPMux* mux, int loop_count) {
 // Delete API(s).
 
 WebPMuxError WebPMuxDeleteChunk(WebPMux* mux, const char fourcc[4]) {
+  if (mux == NULL || fourcc == NULL) return WEBP_MUX_INVALID_ARGUMENT;
   return MuxDeleteAllNamedData(mux, ChunkGetTagFromFourCC(fourcc));
 }
 
diff --git a/src/mux/muxread.c b/src/mux/muxread.c
index ff10b67f..fb83987c 100644
--- a/src/mux/muxread.c
+++ b/src/mux/muxread.c
@@ -271,13 +271,16 @@ static WebPMuxError SynthesizeBitstream(const WebPMuxImage* const wpi,
 
 WebPMuxError WebPMuxGetChunk(const WebPMux* mux, const char fourcc[4],
                              WebPData* chunk_data) {
-  const CHUNK_INDEX idx = ChunkGetIndexFromFourCC(fourcc);
-  if (mux == NULL || chunk_data == NULL || IsWPI(kChunks[idx].id)) {
+  CHUNK_INDEX idx;
+  if (mux == NULL || fourcc == NULL || chunk_data == NULL) {
     return WEBP_MUX_INVALID_ARGUMENT;
   }
-  if (idx != IDX_UNKNOWN) {  // A known chunk type.
+  idx = ChunkGetIndexFromFourCC(fourcc);
+  if (IsWPI(kChunks[idx].id)) {     // An image chunk.
+    return WEBP_MUX_INVALID_ARGUMENT;
+  } else if (idx != IDX_UNKNOWN) {  // A known chunk type.
     return MuxGet(mux, idx, 1, chunk_data);
-  } else {                   // An unknown chunk type.
+  } else {                          // An unknown chunk type.
     const WebPChunk* const chunk =
         ChunkSearchList(mux->unknown_, 1, ChunkGetTagFromFourCC(fourcc));
     if (chunk == NULL) return WEBP_MUX_NOT_FOUND;
diff --git a/src/webp/mux.h b/src/webp/mux.h
index 882e926d..41ea158d 100644
--- a/src/webp/mux.h
+++ b/src/webp/mux.h
@@ -179,7 +179,7 @@ static WEBP_INLINE WebPMux* WebPMuxCreate(const WebPData* bitstream,
 //   copy_data - (in) value 1 indicates given data WILL be copied to the mux
 //               and value 0 indicates data will NOT be copied.
 // Returns:
-//   WEBP_MUX_INVALID_ARGUMENT - if mux or chunk_data is NULL
+//   WEBP_MUX_INVALID_ARGUMENT - if mux, fourcc or chunk_data is NULL
 //                               or if fourcc corresponds to an image chunk.
 //   WEBP_MUX_MEMORY_ERROR - on memory allocation error.
 //   WEBP_MUX_OK - on success.
@@ -195,7 +195,7 @@ WEBP_EXTERN(WebPMuxError) WebPMuxSetChunk(
 //                 e.g., "ICCP", "META" etc.
 //   chunk_data - (out) returned chunk data
 // Returns:
-//   WEBP_MUX_INVALID_ARGUMENT - if either mux or chunk_data is NULL
+//   WEBP_MUX_INVALID_ARGUMENT - if either mux, fourcc or chunk_data is NULL
 //                               or if fourcc corresponds to an image chunk.
 //   WEBP_MUX_NOT_FOUND - If mux does not contain a chunk with the given id.
 //   WEBP_MUX_OK - on success.
@@ -208,7 +208,7 @@ WEBP_EXTERN(WebPMuxError) WebPMuxGetChunk(
 //   fourcc - (in) a character array containing the fourcc of the chunk;
 //                 e.g., "ICCP", "META" etc.
 // Returns:
-//   WEBP_MUX_INVALID_ARGUMENT - if mux is NULL
+//   WEBP_MUX_INVALID_ARGUMENT - if mux or fourcc is NULL
 //                               or if fourcc corresponds to an image chunk.
 //   WEBP_MUX_NOT_FOUND - If mux does not contain a chunk with the given fourcc.
 //   WEBP_MUX_OK - on success.