Limit the amount of RAM allocated for Huffman trees

This will help excessive memory allocation for images not encoded
by libwebp.

BUG: 494764367
Change-Id: I95fc345df541d8b134e455c8c33a496f46746655
This commit is contained in:
Vincent Rabaud
2026-03-24 10:38:24 +01:00
parent d25c11493a
commit 5755839a47
3 changed files with 14 additions and 4 deletions

View File

@@ -59,4 +59,8 @@ enum {
// Check that webp_csp_mode is within the bounds of WEBP_CSP_MODE. // Check that webp_csp_mode is within the bounds of WEBP_CSP_MODE.
int IsValidColorspace(int webp_csp_mode); int IsValidColorspace(int webp_csp_mode);
// Lossless: maximum number of histogram images (sub-blocks). This is defined
// for encoding efficiency, the standard allows for more.
#define MAX_HUFF_IMAGE_SIZE 2600
#endif // WEBP_DEC_COMMON_DEC_H_ #endif // WEBP_DEC_COMMON_DEC_H_

View File

@@ -18,6 +18,7 @@
#include <string.h> #include <string.h>
#include "src/dec/alphai_dec.h" #include "src/dec/alphai_dec.h"
#include "src/dec/common_dec.h"
#include "src/dec/vp8_dec.h" #include "src/dec/vp8_dec.h"
#include "src/dec/vp8li_dec.h" #include "src/dec/vp8li_dec.h"
#include "src/dec/webpi_dec.h" #include "src/dec/webpi_dec.h"
@@ -456,6 +457,7 @@ int ReadHuffmanCodesHelper(int color_cache_bits, int num_htree_groups,
kAlphabetSize[0] + ((color_cache_bits > 0) ? 1 << color_cache_bits : 0); kAlphabetSize[0] + ((color_cache_bits > 0) ? 1 << color_cache_bits : 0);
const int table_size = kTableSize[color_cache_bits]; const int table_size = kTableSize[color_cache_bits];
int* code_lengths = NULL; int* code_lengths = NULL;
int total_huffman_table_size;
if ((mapping == NULL && num_htree_groups != num_htree_groups_max) || if ((mapping == NULL && num_htree_groups != num_htree_groups_max) ||
num_htree_groups > num_htree_groups_max) { num_htree_groups > num_htree_groups_max) {
@@ -466,9 +468,14 @@ int ReadHuffmanCodesHelper(int color_cache_bits, int num_htree_groups,
(int*)WebPSafeCalloc((uint64_t)max_alphabet_size, sizeof(*code_lengths)); (int*)WebPSafeCalloc((uint64_t)max_alphabet_size, sizeof(*code_lengths));
*htree_groups = VP8LHtreeGroupsNew(num_htree_groups); *htree_groups = VP8LHtreeGroupsNew(num_htree_groups);
// MAX_HUFF_IMAGE_SIZE is above what the libwebp encoder allows so something
// fishy might be happening. Do not allocate too much yet.
total_huffman_table_size =
(num_htree_groups_max > MAX_HUFF_IMAGE_SIZE ? MAX_HUFF_IMAGE_SIZE
: num_htree_groups) *
table_size;
if (*htree_groups == NULL || code_lengths == NULL || if (*htree_groups == NULL || code_lengths == NULL ||
!VP8LHuffmanTablesAllocate(num_htree_groups * table_size, !VP8LHuffmanTablesAllocate(total_huffman_table_size, huffman_tables)) {
huffman_tables)) {
VP8LSetError(dec, VP8_STATUS_OUT_OF_MEMORY); VP8LSetError(dec, VP8_STATUS_OUT_OF_MEMORY);
goto Error; goto Error;
} }

View File

@@ -16,6 +16,7 @@
#include <stdlib.h> #include <stdlib.h>
#include <string.h> #include <string.h>
#include "src/dec/common_dec.h"
#include "src/dsp/lossless.h" #include "src/dsp/lossless.h"
#include "src/dsp/lossless_common.h" #include "src/dsp/lossless_common.h"
#include "src/enc/backward_references_enc.h" #include "src/enc/backward_references_enc.h"
@@ -31,8 +32,6 @@
#include "src/webp/format_constants.h" #include "src/webp/format_constants.h"
#include "src/webp/types.h" #include "src/webp/types.h"
// Maximum number of histogram images (sub-blocks).
#define MAX_HUFF_IMAGE_SIZE 2600
#define MAX_HUFFMAN_BITS (MIN_HUFFMAN_BITS + (1 << NUM_HUFFMAN_BITS) - 1) #define MAX_HUFFMAN_BITS (MIN_HUFFMAN_BITS + (1 << NUM_HUFFMAN_BITS) - 1)
// Empirical value for which it becomes too computationally expensive to // Empirical value for which it becomes too computationally expensive to
// compute the best predictor image. // compute the best predictor image.