From 9f547450e0047fba46caeb2605e7a54272f73145 Mon Sep 17 00:00:00 2001
From: Urvang Joshi <urvang@google.com>
Date: Fri, 11 May 2012 14:08:40 +0530
Subject: [PATCH] Catch an error in DecodeImageData().

When we are at end-of-stream, but haven't decoded all pixels, we should
return an error.
Also remove an obsolete TODO.

Change-Id: I3fb1646136e706da536d537a54d1fa487a890630
---
 src/dec/vp8l.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/src/dec/vp8l.c b/src/dec/vp8l.c
index 1a8431df..63b0d8b1 100644
--- a/src/dec/vp8l.c
+++ b/src/dec/vp8l.c
@@ -596,14 +596,12 @@ static int DecodeImageData(VP8LDecoder* const dec,
       const int length_sym = code - NUM_LITERAL_CODES;
       const int length = GetCopyLength(length_sym, br);
       const int dist_symbol = ReadSymbol(&htree_group->htrees_[DIST], br);
-      // TODO(urvang): Evaluate if we should check 'dist_symbol', 'dist_code'
-      // and/or 'dist' to be valid.
       VP8LFillBitWindow(br);
       dist_code = GetCopyDistance(dist_symbol, br);
       dist = PlaneCodeToDistance(width, dist_code);
       if (src - data < dist || src_end - src < length) {
         ok = 0;
-        goto Error;
+        goto End;
       }
       {
         int i;
@@ -636,16 +634,16 @@ static int DecodeImageData(VP8LDecoder* const dec,
       goto AdvanceByOne;
     } else {    // Not reached.
       ok = 0;
-      goto Error;
+      goto End;
     }
     ok = !br->error_;
-    if (!ok) goto Error;
+    if (!ok) goto End;
   }
   // Process the remaining rows corresponding to last row-block.
   if (process_row) ProcessRows(dec, row);
 
- Error:
-  if (br->error_ || !ok) {
+ End:
+  if (br->error_ || !ok || (br->eos_ && src < src_end)) {
     ok = 0;
     dec->status_ = (!br->eos_) ?
         VP8_STATUS_BITSTREAM_ERROR : VP8_STATUS_SUSPENDED;