dany/libwebp
1
0
Fork 0
mirror of https://github.com/webmproject/libwebp.git synced 2024-11-20 04:18:26 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

idec: fix internal state corruption

Browse Source 
A call to Append/Update would index the parts_ array w/-1 as num_parts_
had yet to be set by DecodePartition0. This would cause corruption
within the VP8Decoder member.

Fixes issue #106.

Change-Id: Ib9f2811594ff19e948a66fda862a4e0a384bb9aa
This commit is contained in:
James Zern 2012-01-31 15:17:49 -08:00
parent 01b6380656
commit 7bb6a9ccd6
2 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/dec/idec.c
View File

@ -127,6 +127,7 @@ static int AppendToMemBuffer(WebPIDecoder* const idec,
memcpy(mem->buf_ + mem->end_, data, data_size); memcpy(mem->buf_ + mem->end_, data, data_size);
mem->end_ += data_size; mem->end_ += data_size;
assert(mem->end_ <= mem->buf_size_); assert(mem->end_ <= mem->buf_size_);
assert(last_part >= 0);
dec->parts_[last_part].buf_end_ = mem->buf_ + mem->end_; dec->parts_[last_part].buf_end_ = mem->buf_ + mem->end_;
// note: setting up idec->io_ is only really needed at the beginning // note: setting up idec->io_ is only really needed at the beginning
@ -155,6 +156,7 @@ static int RemapMemBuffer(WebPIDecoder* const idec,
REMAP(dec->parts_[p].buf_end_, base, data); REMAP(dec->parts_[p].buf_end_, base, data);
} }
} }
assert(last_part >= 0);
dec->parts_[last_part].buf_end_ = data + data_size; dec->parts_[last_part].buf_end_ = data + data_size;
// Remap partition #0 data pointer to new offset. // Remap partition #0 data pointer to new offset.

1
src/dec/vp8.c
View File

@ -47,6 +47,7 @@ VP8Decoder* VP8New(void) {
SetOk(dec); SetOk(dec);
WebPWorkerInit(&dec->worker_); WebPWorkerInit(&dec->worker_);
dec->ready_ = 0; dec->ready_ = 0;
dec->num_parts_ = 1;
} }
return dec; return dec;
} }