This reverts commit 2246828be3.
Reason for revert: NULL dereferences in the fuzzers.
The `VP8LPredictorsAdd_SSE` table is not completely initialized (index
14 and 15) which may be accessed with an invalid bitstream.
Bug: 435213378
Original change's description:
> dsp/lossless{,_enc}_sse2.c: reorder *_SSE assignments
>
> When `WEBP_USE_THREAD` is not defined the assignments of *_SSE and their
> unsuffixed counterparts may race. Assigning *_SSE directly rather than
> relying on the unsuffixed values avoids a case where the *_SSE variants
> may refer to the calling function (i.e., AVX2) resulting in infinite
> recursion.
>
> Defining `WEBP_USE_THREAD` is recommended when decode/encode calls can
> be made from different threads.
>
> Bug: 435213378
> Change-Id: Id5549730cb72be99b3014ed8e4e355f3ea988659
Bug: 435213378, 438295348, 438294044, 438264629, 438294033
Change-Id: I3299d6fbb29c45872e2ea1f8f1c3d0ebbda64a69
When `WEBP_USE_THREAD` is not defined the assignments of *_SSE and their
unsuffixed counterparts may race. Assigning *_SSE directly rather than
relying on the unsuffixed values avoids a case where the *_SSE variants
may refer to the calling function (i.e., AVX2) resulting in infinite
recursion.
Defining `WEBP_USE_THREAD` is recommended when decode/encode calls can
be made from different threads.
Bug: 435213378
Change-Id: Id5549730cb72be99b3014ed8e4e355f3ea988659
SRWLOCK is faster than CRITICAL_SECTION. MSVC implements the C11 mtx_t
and C++ std::mutex using SRWLOCK.
Change-Id: I144d2f53aeaa135030ea8c057a2ae8543e6c91b8
Assume the CONDITION_VARIABLE added in Windows Vista is available.
Remove an unneeded WaitForSingleObject() macro that converts
WaitForSingleObject() calls to WaitForSingleObjectEx() calls with
bAlertable=FALSE. The WaitForSingleObject() function does not enter an
alertable wait state, so it is equivalent to WaitForSingleObjectEx()
with bAlertable=FALSE.
Remove code for Windows older than Vista in src/dsp/cpu.h.
Change-Id: I7df95557713923e05a7bfb62e095ec6172cfd708
Trying to compile libwebp with CMAKE_OSX_ARCHITECTURES="x86_64;arm64"
(also called as universal binary), will always fail due to SIMD
intrinsics check. CMake passes `-arch x86_64 -arch arm64` into the
compiler during `check_c_source_compiles`, which will always fail for
any flag, because either x86_64 or arm64 won't have it. This also
results in you not being able to compile the library due to errors like
"SSE2 register return with SSE2 disabled".
Change-Id: I32a41e4c64ce8c6a043083023a4018d512be124b
Import bounds_safety.h across all of webputils, with one exception being
dsp.h, since it's imported by webputils.h in one place. Also prepend
WEBP_ASSUME_UNSAFE_INDEXABLE_ABI to every webputil file to indicate to
the compiler that every pointer should be treated as __unsafe_indexable.
We also need to replace memcpy/memset/memmove with the unsafe variants
WEBP_UNSAFE_*, as memcpy/memset/memmove require bounded/sized pointers.
With this change, all of libwebputils (and libwebp) should build with
-DWEBP_ENABLE_FBOUNDS_SAFETY=true
Change-Id: Iad87be0455182d534c074ef6dc1a30fa66b74b6c
A slim reader/writer (SRW) lock can be initialized statically with the
constant SRWLOCK_INIT. It is the only Windows synchronization object I
can find with this property.
Note: On old Windows versions that don't have SRWLOCK, use the fallback,
thread-unsafe implementation.
Change a NOLINT comment to a NOLINTNEXTLINE comment to prevent
clang-format from aligning the #else and #endif comments in undesired
way.
Bug: 435213378
Change-Id: Iecff615a14a1905aedd2c05ad9444889f711cc17
shellapi.h must be included after windows.h; fixes:
/Windows Kits/10/Include/10.0.26100.0/um/shellapi.h|68 col 1| error:
unknown type name 'EXTERN_C'
when building using VS 2022 after:
44257cb8 apply clang-format
Bug: 433996651
Change-Id: I8f340cdaf6d6b315f1b7535710847db786599da1
Function static variables are initialized on the first call to the
function. In C the initialization of function static variables is not
thread-safe. Use file static variables instead in the
WEBP_DSP_INIT_FUNC() macro.
Remove the volatile qualifier for the pthread version of the
func##_last_cpuinfo_used variable because the variable is only accessed
while holding the mutex.
Change-Id: I1237904a49d2467d7ce79fc53f9e7f966aa7a5c1
Google style, with no overrides. This may help automatic formatting in
some tools that don't pass `--style` by default.
Bug: 433996651
Change-Id: I5fb28f43bd3dd1862aaf89b73a24dfb63f80a193
(Debian clang-format version 19.1.7 (3+build4)) with `--style=Google`.
Manual changes:
* clang-format disabled around macros with stringification (mostly
assembly)
* some inline assembly strings were adjusted to avoid awkward line
breaks
* trailing commas, `//` or suffixes (`ull`) added to help array
formatting
* thread_utils.c: parameter comments were changed to the more common
/*...=*/ style to improve formatting
The automatically generated code under swig/ was skipped.
Bug: 433996651
Change-Id: Iea3f24160d78d2a2653971cdf13fa932e47ff1b3
Rather than encoding all candidates then finding the smallest output,
only keep the frame candidate leading to the shortest bitstream at all
times. Some memory is released slightly sooner when there are more
than two frame candidates.
The simple assignments in PickBestCandidate() are now done for each
new best candidate so far instead of once for the one best overall
candidate, but they are cheap and overwritten. This change should
have no impact on encoded animation files.
Change-Id: Ie540f104a70de7a84535f8f2c49d1a71fa5b4bfa
`ok &= ...` is more common in the codebase than `ok = ... && ok` when
accumulating a result while unconditionally executing functions. (`ok =
ok &&` is used in cases that should short circuit.) In this case
multiple checks may fail and their error messages may aid in debugging.
This will also improve the formatting when clang-format is applied to
the codebase.
Bug: 433996651
Change-Id: Ie4e2908b857122d90f6e93f06b10cb48dc86b18e
in calls to `LOCAL_FREE()`: `(W_CHAR** const) -> (W_CHAR**)`. This will
improve formatting when clang-format is applied.
Bug: 433996651
Change-Id: I54e62206c83473e9369b8c67fb8d6c44d7808d52
When the next frame is forced to be a keyframe by setting
enc->best_delta to DELTA_INFINITY, setting enc->keyframe to NONE means
the current frame will never be converted from a candidate keyframe to
a subframe. So enc->prev_candidate_undecided should be set to 0.
This is a no-op change because enc->prev_candidate_undecided is only
used to update prev_rect and dispose method, which is of no value when
the next frame is a key frame.
Change-Id: Ie51c7e3b6ba797b75af5e06439e8568d8185693f
The macros in src/utils/bounds_safety.h exist to ensure libwebp
stays portable. This also provides wrappers around common functions like
memcpy/memset/memmove, which are useful as part of the migration. Memcpy
(et al.) wrappers aren't expected to exist forever, and can be removed
after the codebase is fully annotated.
There's some complexity here due to the number of states we need to
support:
1) Off everywhere
2) Building libwebp (some or all) with -fbounds-safety
3) Linking against libwebp that was built with -fbounds-safety
4) Inter-operation with C++
Change-Id: I789f0a94f25b70cab172d5b3f5e6b12de3a34bb4
Rename them to WebPConvertRGBToY/WebPConvertBGRToY and accept the
'step' parameter (3 for RGB, 4 for ARGB).
Change-Id: I930a23894e4135a34fff2174e6a5bbee1eac2ba0
Conditionally enable -fbounds-safety for webputils
This is the first step towards making -fbounds-safety
(https://clang.llvm.org/docs/BoundsSafety.html) available to folks with
a supported toolchain.
In the next CL, I'll provide a header file which wraps the annotations,
keeping the code portable. It will also address the build failures below
by marking the webputils files as "default unsafe", which shouldn't
change any behavior (build or runtime) when -fbounds-safety is disabled.
Example using a toolchain built from github.com/swiftlang/llvm-project/next
```
$ mkdir build && cd build
$ cmake .. -DCMAKE_C_COMPILER=$(pwd)/../llvm-build/bin/clang -DCMAKE_CXX_COMPILER=$(pwd)/../llvm-build/bin/clang++ -DWEBP_ENABLE_FBOUNDS_SAFETY=true
$ make
...
[ 74%] Building C object CMakeFiles/webputils.dir/src/utils/bit_reader_utils.c.o
In file included from libwebp/src/utils/bit_reader_utils.c:23:
In file included from libwebp/src/utils/bit_reader_inl_utils.h:30:
libwebp/src/utils/utils.h:72:14: error: passing 'const uint8_t *__single' (aka 'const unsigned char *__single') with pointee of size 1 to parameter '__src' of type
'const void *__single __sized_by(__n)' (aka 'const void *__single') with size value of 4 always fails
72 | memcpy(&A, ptr, sizeof(A));
| ^ ~~~~~~~~~
...
```
Bug: webp:432511821
Change-Id: Ie3db8d29445f2cff06e2ee180f5dd454acedbae3
libwebp-1.6.0
- 6/30/2025 version 1.6.0
This is a binary compatible release.
API changes:
- libwebp: WebPValidateDecoderConfig
* additional x86 (AVX2, SSE2), general optimizations and compression
improvements for lossless
* `-mt` returns same results as single-threaded lossless (regressed in
1.5.0, #426506716)
* miscellaneous warning, bug & build fixes (#393104377, #397130631,
#398288323, #398066379, #427503509)
Tool updates:
* cwebp can restrict the use of `-resize` with `-resize_mode` (#405437935)
Bug: webp:427525168
* tag 'v1.6.0':
update ChangeLog
webp_js/README.md: add some more code formatting (``)
CMakeLists: add warning for incorrect emscripten config
update ChangeLog
api.md: add WebPValidateDecoderConfig to pseudocode
update NEWS
bump version to 1.6.0
update AUTHORS
Change-Id: Ia4962eff9c197c42c77c9eadd35cdeee3586510e
`-DWEBP_BUILD_WEBP_JS=1` requires `emcmake` and `emmake`. Attempt to
detect `emcmake` usage by checking for the `EMSCRIPTEN_VERSION`
variable and issue a warning if it is not set. This may help avoid a
surprising build error as `cmake` itself will succeed:
```
$ make
[...]
[100%] Building C object CMakeFiles/webp_wasm.dir/extras/webp_to_sdl.c.o
clang: error: no such file or directory: 'SDL2::SDL2'
```
Bug: webp:427525168
Change-Id: I4f5fa2ffbbc4123e28172f2b7ef952a1b1a687bf
And provide a clear comment explaining why the index of offset[] is
always checked within bounds.
Bug:webp:622
Change-Id: Id9b973a804b74c53dfb291f1a9dae649c0daed9d
If extra arguments after -get/-set matched one of the recognized
keywords ('icc', 'xmp', etc.), the parser would overwrite the
`config->args[]` allocation, as only one argument was expected.
The additional arguments are now treated as input files. This has the
side effect of allowing input files to be named the same as one of the
keywords.
Bug: webp:427503509
Change-Id: Ic48c94b75349109638e938781024be0a783ff267
This is a refinement of
654bfb04 Avoid nullptr arithmetic in VP8BitReaderSetBuffer
and removes an unneeded/redundant check in 2 of the 3 calls to this
function:
* VP8InitBitReader: `start` is guaranteed to be non-NULL
* CopyParts0Data: `start` is allocated and checked
In `DoRemap()` `last_start` will be NULL before the partitions are
parsed. This is the only call that was missing a check. The offsetting
of a NULL pointer in `VP8BitReaderSetBuffer` was harmless in this case
as the bitreader will not be used meaningfully until there is enough
data to begin decoding partition 0. In that case the bitreader will be
initialized by `ParsePartitions()` and updated by `DoRemap()` when more
data is available.
Bug: 393104377
Change-Id: Ib44bc35e00e5129c592d742a2469420cd3d0e858
