This function may fail due to allocation failures. Use the
NALLOC_FUZZ_VERSION environment variable to detect the engine. This was
added in:
9c9a9883cc
Change-Id: Ia5b6fd9458ffa1f810152a10ab49a48c75d17687
If ReadBits(0) == 0, the value of max_symbol is set to the alphabet size
for each symbol type.
See vp8l_dec.c, ReadHuffmanCode(), which passes alphabet_size to
ReadHuffmanCodeLengths() as num_symbols, and ReadHuffmanCodeLengths()
then sets max_symbol to that.
Bug: webp:611
Change-Id: I662bd1d7f372e7f2e9c71cc86f87aefd02f36647
Make Entropy Image and Interpretation of Meta Prefix Codes their own
section for ease of reference.
Bug: webp:611
Change-Id: I2dba7b4efd02d8bb250810ebff42ac1687262804
follow up to:
29c9f2d4 webp-lossless-bitstream-spec: minor wording updates
Universally use 'transform' over 'transformation'. The doc generally
uses 'transform' to talk about the individual transforms themselves as
well as their related data.
Bug: webp:611
Change-Id: I097701873bbc440bd399ab5440a914a14f7c62f6
The last use of #decoding-the-code-lengths was removed in:
86f94ee0 Update lossless spec with Huffman codes.
Also remove the redundant section header associated with it.
Bug: webp:611
Change-Id: I7f6bb1a1b75255324f185f4591313d9e6d49d1e9
Users of the encoder (including anim_encode.c) and areas of the encoder
itself rely on the status returned via WebPPicture.
Change-Id: Id786176b8ac3b2329d1e41b9dacbb8dcc5d822e4
VP8LBitWriterFinish() may cause the VP8LBitWriter's buffer to be grown.
If that allocation fails, VP8LBitWriterNumBytes() will return a size
larger than the current allocation resulting in a heap overwrite of the
missing bytes.
==13==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x61900005b880 at pc 0x00000049ffc1 bp 0x7fff144f5b40 sp 0x7fff144f5310
READ of size 1028 at 0x61900005b880 thread T0
#0 0x49ffc0 in __asan_memcpy
#1 0x695861 in VP8BitWriterAppend src/utils/bit_writer_utils.c:186:3
#2 0x65acf9 in EncodeAlphaInternal src/enc/alpha_enc.c:169:14
Found by Nallocfuzz (https://github.com/catenacyber/nallocfuzz).
This is the same issue that was fixed in the non-alpha lossless path in:
d49cfbb3 vp8l_enc,WriteImage: add missing error check
Bug: chromium:1455619
Change-Id: I6bd10de213707d3d6b7ce3d0d2b3942af45d317f
Remove the ambiguous 'should' which in other contexts might result in
questions as to whether it is a SHOULD or a MUST.
Change-Id: I9b396187ebde5ea5a0dbaf42daee6acf541258cd
VP8LBitWriterFinish() may cause the VP8LBitWriter's buffer to be grown.
If that allocation fails, VP8LBitWriterNumBytes() will return a size
larger than the current allocation resulting in a heap overwrite of the
missing bytes.
==3531848==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x61d000000880 at pc 0x556eddfa1007 bp 0x7ffe434c7a90 sp 0x7ffe434c7260
READ of size 2052 at 0x61d000000880 thread T0
#0 0x556eddfa1006 in __asan_memcpy
#1 0x556eddfeeccf in WebPMemoryWrite src/enc/picture_enc.c:220:5
#2 0x556ede0f9f87 in WriteImage src/enc/vp8l_enc.c:1454:8
Found by Nallocfuzz (https://github.com/catenacyber/nallocfuzz).
Change-Id: Ib1c9454c2c51849b0ba58c5347e6bd5b02a12fbe
This prevents leaks should an allocation fail.
Spotted by Philippe Antoine (p dot antoine at catenacyber dot fr)
and https://github.com/catenacyber/nallocfuzz.
Change-Id: I07a8a475a282b18bf2f9015cc5b1120772babd48
The default was changed from 5MB to 64KB in 3.1.27 [1] causing image
decodes to fail. This restores the old default. In testing, 1536KB was
enough for the sample image, 1024KB was not.
[1]: https://github.com/emscripten-core/emscripten/blob/main/ChangeLog.md#3127---112922
Bug: webp:614
Change-Id: I1ff7afc72fa49d88d2efe88d2a04dfadbea3b1a5
Fixed: webp:614
Test: emcc 3.1.18 & 3.1.41
The buffers are made mandatory to match WebPDecodeYUVInto(), though this
conflicts with WebPIDecGetYUVA().
spotted by Oliver Kunz (okunz at google dot com)
Change-Id: Ic4740c53b75da6b93d4f3462303fb9be0ebfbd48
After the png_read_update_info() call, call png_get_channels() to find
out if the image has alpha.
Change-Id: I6fa709418744b4de90d10ff96eaeefe454ffa290
Within the 'Entropy image' subsection, its clear this is what is being
described in the following paragraphs. Remove 'as described below' from
the first sentence.
Bug: webp:611
Change-Id: I365d69c8f6963cd826849ebdd96e46206d38b55d
Move this to the top-level of the "Details" section as prefix codes are
discussed in both "Decoding and Building the Prefix Codes" and "Decoding
of Meta Prefix Codes"
Bug: webp:611
Change-Id: Ide2dfedf081d6c94122ac16ecded968ed760f90c
in the Transformations section describing decoding of the transform
data followed by the image data. The section numbers were adjusted by 1
in:
337cf69f webp-lossless-bitstream-spec: mv Nomenclature after Intro
Bug: webp:611
Change-Id: I4eede0d068fabdef51a140a0268436ab6629e8bb
Give some examples of repetition and binary value notation to limit the
need to follow the ABNF reference.
Bug: webp:611
Change-Id: I5b5a7632f011e1523b4a528653fe3630afba3e3e
in 6.2.3 Decoding Entropy-Coded Image Data.
The copying of distance code pixels cause some confusion during the
AUTH48 portion of the RFC review process.
Bug: webp:611
Change-Id: I78f547ae10c95f180355a4c93ec6d48acdc09141
Mostly grammatical and addition/subtraction of commas from the AUTH48
portion of the RFC review process.
The serial comma changes are based on the Chicago Manual of Style
(CMOS), 17th edition.
Bug: webp:611
Change-Id: I5ae2d1cc0196009dbf3a4c2195cc73c2ef809b49
preprocessing bits are informative, not the filtering bits.
since:
391f9db9 Ordering of description of bits in container spec
Change-Id: I1c0da963074ce9cf4d33a13b4b36c9421b3e3b9d
Mostly grammatical and addition/subtraction of commas from the AUTH48
portion of the RFC review process.
The serial comma changes are based on the Chicago Manual of Style
(CMOS), 17th edition.
Change-Id: Ic75abf2e53e09c8a849e28e9c40e16c127515287
The histograms count the occurrences of len/dist in entropy images.
Those (at most (1<<14) by (1<<14)) are sub-sampled by at least
MIN_HUFFMAN_BITS == 2, hence at most 24 bits in a histogram value.
At most, we multiply by 19 (because the longest histogram is of
size 40 and we do 40>>1, cf code) for the bit cost. So it all fits
in 32 bits.
Change-Id: Ife24b035f54794851ff31f2fac07901f724c6d7f
