From 9fc64edc215cc2d49c310adb77d6a200958bef92 Mon Sep 17 00:00:00 2001
From: Vikas Arora <vikasa@google.com>
Date: Wed, 23 May 2012 16:09:53 +0530
Subject: [PATCH] Disallow re-use of same transformation.

Limit the overall number of transformations to 4 and disallow any
duplicate transform for decoding an image.

Change-Id: Ic4b0ecd553db96702e117fd073617237d95e45c0
---
 src/dec/vp8l.c  | 11 +++++++++--
 src/dec/vp8li.h |  2 +-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/dec/vp8l.c b/src/dec/vp8l.c
index 9133a1b5..c29c3f1d 100644
--- a/src/dec/vp8l.c
+++ b/src/dec/vp8l.c
@@ -707,15 +707,22 @@ static int ExpandColorMap(int num_colors, VP8LTransform* const transform) {
 
 static int ReadTransform(int* const xsize, int const* ysize,
                          VP8LDecoder* const dec) {
+  int i;
   int ok = 1;
   VP8LBitReader* const br = &dec->br_;
   VP8LTransform* transform = &dec->transforms_[dec->next_transform_];
   const VP8LImageTransformType type =
       (VP8LImageTransformType)VP8LReadBits(br, 2);
 
-  if (dec->next_transform_ == NUM_TRANSFORMS) {
-    return 0;
+  // Each transform type can only be present once in the stream.
+  // TODO(later): use a bit set to mark already-used transforms.
+  for (i = 0; i < dec->next_transform_; ++i) {
+    if (dec->transforms_[i].type_ == type) {
+      return 0;  // Already there, let's not accept the second same transform.
+    }
   }
+  assert(dec->next_transform_ < NUM_TRANSFORMS);
+
   transform->type_ = type;
   transform->xsize_ = *xsize;
   transform->ysize_ = *ysize;
diff --git a/src/dec/vp8li.h b/src/dec/vp8li.h
index 7f96bf9d..f6738914 100644
--- a/src/dec/vp8li.h
+++ b/src/dec/vp8li.h
@@ -23,7 +23,7 @@
 extern "C" {
 #endif
 
-#define NUM_TRANSFORMS               8
+#define NUM_TRANSFORMS               4
 #define HUFFMAN_CODES_PER_META_CODE  5
 #define ARGB_BLACK                   0xff000000
 #define NUM_LITERAL_CODES            256