dany/libwebp
1
0
Fork 0
mirror of https://github.com/webmproject/libwebp.git synced 2026-04-09 14:22:31 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

ALPHInit: move assignment closer to first use

Browse Source 
This fixes a spurious unsigned integer overflow with invalid content:

```
src/dec/alpha_dec.c:61:44: runtime error: unsigned integer overflow: 0 -
  1 cannot be represented in type 'size_t' (aka 'unsigned long')
```

Bug: 498965803, 498966235, 498966511, 498967090
Change-Id: I350d9144d0c1e4e35286e9e1ca68a574ff6f86a1
This commit is contained in:
James Zern
2026-04-02 10:20:09 -07:00
parent 0c9546f7ef
commit c696aadf69
5 changed files with 76 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
tests/fuzzer/animation_api_fuzzer.cc
View File

@@ -16,9 +16,11 @@
#include <cstddef>
#include <cstdint>
#include <string>
#include <string_view>
#include "./fuzz_utils.h"
#include "gtest/gtest.h"
#include "webp/decode.h"
#include "webp/demux.h"
#include "webp/mux_types.h"
@@ -88,3 +90,15 @@ FUZZ_TEST(AnimationApi, AnimationApiTest)
// Animations only support 4 (out of 12) modes.
fuzztest::ElementOf<WEBP_CSP_MODE>({MODE_RGBA, MODE_BGRA,
MODE_rgbA, MODE_bgrA}));
TEST(AnimationApi, Buganizer498965803) {
AnimationApiTest(
std::string("ALPH\000\000\000\000\000\000\000\000\021\000\000\000\t\305"
"\006d\301\013\177\000\000webp\034\205\000#@VP8 "
"!\000\000\000v\003\000\235\001*\007\200\"\000\0020("
"\000\377\377\377\003\000\000\000\311\311\311\311\311\311\311"
"\311\311\311\311\311\311\311\311\311\311\311\311\311\311\211"
"\311\311\311\311\311\030\030\030\030\030\030\311\311",
98),
false, static_cast<WEBP_CSP_MODE>(1));
}