From 59a2b1f9e3667bb56e28253911452f4a46607c65 Mon Sep 17 00:00:00 2001
From: James Zern <jzern@google.com>
Date: Mon, 12 Jun 2023 22:04:33 +0000
Subject: [PATCH] WebPDecodeYUV: check u/v/stride/uv_stride ptrs

The buffers are made mandatory to match WebPDecodeYUVInto(), though this
conflicts with WebPIDecGetYUVA().

spotted by Oliver Kunz (okunz at google dot com)

Change-Id: Ic4740c53b75da6b93d4f3462303fb9be0ebfbd48
---
 src/dec/webp_dec.c | 31 +++++++++++++++++++------------
 src/webp/decode.h  |  5 +++--
 2 files changed, 22 insertions(+), 14 deletions(-)

diff --git a/src/dec/webp_dec.c b/src/dec/webp_dec.c
index 3f4f7bb6..f557868b 100644
--- a/src/dec/webp_dec.c
+++ b/src/dec/webp_dec.c
@@ -658,19 +658,26 @@ uint8_t* WebPDecodeBGRA(const uint8_t* data, size_t data_size,
 uint8_t* WebPDecodeYUV(const uint8_t* data, size_t data_size,
                        int* width, int* height, uint8_t** u, uint8_t** v,
                        int* stride, int* uv_stride) {
-  WebPDecBuffer output;   // only to preserve the side-infos
-  uint8_t* const out = Decode(MODE_YUV, data, data_size,
-                              width, height, &output);
-
-  if (out != NULL) {
-    const WebPYUVABuffer* const buf = &output.u.YUVA;
-    *u = buf->u;
-    *v = buf->v;
-    *stride = buf->y_stride;
-    *uv_stride = buf->u_stride;
-    assert(buf->u_stride == buf->v_stride);
+  // data, width and height are checked by Decode().
+  if (u == NULL || v == NULL || stride == NULL || uv_stride == NULL) {
+    return NULL;
+  }
+
+  {
+    WebPDecBuffer output;   // only to preserve the side-infos
+    uint8_t* const out = Decode(MODE_YUV, data, data_size,
+                                width, height, &output);
+
+    if (out != NULL) {
+      const WebPYUVABuffer* const buf = &output.u.YUVA;
+      *u = buf->u;
+      *v = buf->v;
+      *stride = buf->y_stride;
+      *uv_stride = buf->u_stride;
+      assert(buf->u_stride == buf->v_stride);
+    }
+    return out;
   }
-  return out;
 }
 
 static void DefaultFeatures(WebPBitstreamFeatures* const features) {
diff --git a/src/webp/decode.h b/src/webp/decode.h
index d9824750..0177b120 100644
--- a/src/webp/decode.h
+++ b/src/webp/decode.h
@@ -81,10 +81,11 @@ WEBP_EXTERN uint8_t* WebPDecodeBGR(const uint8_t* data, size_t data_size,
 // returned is the Y samples buffer. Upon return, *u and *v will point to
 // the U and V chroma data. These U and V buffers need NOT be passed to
 // WebPFree(), unlike the returned Y luma one. The dimension of the U and V
-// planes are both (*width + 1) / 2 and (*height + 1)/ 2.
+// planes are both (*width + 1) / 2 and (*height + 1) / 2.
 // Upon return, the Y buffer has a stride returned as '*stride', while U and V
 // have a common stride returned as '*uv_stride'.
-// Return NULL in case of error.
+// 'width' and 'height' may be NULL, the other pointers must not be.
+// Returns NULL in case of error.
 // (*) Also named Y'CbCr. See: https://en.wikipedia.org/wiki/YCbCr
 WEBP_EXTERN uint8_t* WebPDecodeYUV(const uint8_t* data, size_t data_size,
                                    int* width, int* height,