First, BuildHuffmanTable is called to check if the data is valid.
If it is and the table is not big enough, more memory is allocated.
This will make sure that valid (but unoptimized because of unbalanced
codes) streams are still decodable.
(cherry picked from commit 902bc91)
Change-Id: I3abe4db460dcac62c14a84832284c0b530630af2
This is a backported fix for: CVE-2020-36332
This is a merge of:
dce5d7643177633ebe3513af492ea8c08c299cf3
39cb9aad85ca7bb1d193013460db1f8cc6bff109
067031eaed11e91d9914e1e872738c7bdf075e0b
Change-Id: Iab84d2ca459327cdcee1038499842d30370fe486
This avoids a double free should the function fail prior to
VP8BitWriterInit() and a previous trial result's buffer carried over.
Previously in ApplyFiltersAndEncode() trial.bw (with a previous
iteration's buffer) would be freed, followed by best.bw pointing to the
same buffer.
Since:
187d379d add a fallback to ALPHA_NO_COMPRESSION
In addition, check the return value of VP8BitWriterInit() in this
function.
Bug: webp:603
Change-Id: Ic258381ee26c8c16bc211d157c8153831c8c6910
(cherry picked from commit a486d800b60d0af4cc0836bf7ed8f21e12974129)
previously failures in the call to
VP8LBackwardReferencesTraceBackwards() would be ignored which, though it
wouldn't result in a crash, would produce non-deterministic output
Change-Id: Id9890a60883c3270ec75e968506d46eea32b76d4
(cherry picked from commit e3cfafaf719c2e163d3548d7a415da96fdff714f)
(cherry picked from commit 20ef03ee351d4ff03fc5ff3ec4804a879d1b9d5c)
(cherry picked from commit 89e226a3c70ae04fe8e1884aa0b291f39adb2fdf)
change CostManager to calloc to avoid frees on undefined pointer
values in CostManagerClear() should the cost_model allocation succeed,
but the cost_manager allocation fail
since:
v0.5.0-93-g3e023c17 Speed-up BackwardReferencesHashChainDistanceOnly.
Tested:
for i in `seq 1 639`; do
export MALLOC_FAIL_AT=$i
./examples/cwebp -m 6 -q 100 -lossless jpeg_file
done
Bug: webp:565
Change-Id: I376d81e6f41eb73529053e9e30c142b4b4f6b45b
(cherry picked from commit a828a59b49d2e3fbc40dc42a6ee6426cd0f2c9dc)
(cherry picked from commit dd80bb43431c222762be47fd92f8a37e032bc2c0)
(cherry picked from commit 4d0964cd0c2b20668d77f965a7e2fbe0b7dcaea4)
initialize bw_side before calling EncoderAnalyze() & EncoderInit() which
may fail; previously this would cause a free of an invalid pointer in
VP8LBitWriterWipeOut().
since at least:
v0.6.0-120-gf8c2ac15 Multi-thread the lossless cruncher.
Tested:
for i in `seq 1 639`; do
export MALLOC_FAIL_AT=$i
./examples/cwebp -m 6 -q 100 -lossless jpeg_file
done
Bug: webp:565
Change-Id: I1c95883834b6e4b13aee890568ce3bad0f4266f0
(cherry picked from commit fe153fae98a3fe4626ff537ec8d5f4477cec5739)
(cherry picked from commit ddd65f0d19bc6a3acbc48e49d315140ccf099b9a)
(cherry picked from commit 5d805f72051f0ae8aae61bbe1927c1a4bf9617ab)
one instance was overlong leading to a int64->uint32 conversion warning
Change-Id: I56d5ab75d89960c79293f62cd489d7ab519bbc34
(cherry picked from commit 03d12190552c3e95d31aa00303f28a8a2f813bdd)
the trailing width % 8 bytes would clear the upper bytes of
alpha_mask as they're done one at a time
since:
49d0280d NEON: implement several alpha-processing functions
Change-Id: Iff76c0af3094597285a6aa6ed032b345f9856aae
(cherry picked from commit 924e7ca6540d1ac0a2b1b92ee094a64391de0c09)
The available size was not checked before parsing the VP8X data
BUG=oss-fuzz:9100,oss-fuzz:9123,webp:512
Change-Id: I0143cc4554883c1015e2f084a0e371229e04a8ca
(cherry picked from commit 95fd65070662e01cc9170c4444f5c0859a710097)
(cherry picked from commit c0226fd91cbe5fa6fbf5a68dcc9acc9dbe1e358e)
idec_dec.c, DecodeRemaining: Set decoder state to ERROR to prevent VP8ExitCritical to be called again
BUG=webp:512
Change-Id: Id5f893f45c348e1c529680d930e640f780a73d4c
(cherry picked from commit 9e729fe19bb60f4ecac357a3d3f5c5c64dd080d2)
(cherry picked from commit a14e0f646550f90c22395f613b9dda1c90401266)
CopyBlock8b() was over-using memcpy() of 16b values.
BUG=webp:393,webp:512
Change-Id: Id56f10d334b9a453fbcf50dabfaa63529bcff7e5
(cherry picked from commit 211f37ee633aa31c37160c84cc9b868c10fbe8b9)
(cherry picked from commit 667d17a8a403e0768cccf585455cf12807cd1604)
treat an ANMF chunk containing multiple VP8/VP8L file as malformed.
fixes a WebPMuxImage::img_ leak.
Though the invalid free in #9106 was avoided in (ubsan):
be738c6d muxread,ChunkVerifyAndAssign: validate chunk_size
that file would still cause a leak similar to #9099.
BUG=oss-fuzz:9099,oss-fuzz:9106,webp:512
Change-Id: Ib873446a1188afeeb2fe5d53a86b75e0c5de9573
(cherry picked from commit eb82ce76ddca13ad6fb13376bb58b9fd3f850e9e)
(cherry picked from commit f4cf238a415542140dfb877d4ddee9a2b11b8183)
(we also limit radius based on height too, for good measure, although it's not an asan bug)
fixes oss-fuzz issue #9105
BUG=webp:512
Change-Id: Ie0d79dd81480dc4e2b653b7e992e5cdcd3dfa834
(cherry picked from commit 1344a2e947c749d231141a295327e5b99b444d63)
(cherry picked from commit 61ff26aeeb87386f2e1ee377d7bbe1f1ef248e3f)
before accounting for padding which might overflow if chunk_size is >
MAX_CHUNK_PAYLOAD.
BUG=webp:387,webp:388,webp:512
Change-Id: I3985b8817ed4faaec0629102c5333c228a0e9c98
(cherry picked from commit be738c6d396fa5a272c1b209be4379a7532debfe)
(cherry picked from commit 6f643f2417837286d6ab34f22e573840f4d88df6)
previously when adjusting size down based on a smaller riff_size the
checks were insufficient to prevent 'size -= RIFF_HEADER_SIZE' from
rolling over causing ChunkVerifyAndAssign to over read. the new checks
are imported from demux.c.
BUG=webp:386,webp:512
Change-Id: If863c4a9892977b9ade7dd894392a0ecae13775c
(cherry picked from commit 2c70ad76c94db5427d37ab4b85dc89b94dd75e01)
(cherry picked from commit 706ff9c325d755060a22a20af336ef913b8c5bac)
with loop_compatibility disabled (the default), non-zero loop counts
will be incremented by 1 for browser rendering compatibility. the max,
65535, is a special case as the muxer will fail if it is exceeded; avoid
increasing the limit in this case. this isn't 100% correct, but should
be close enough given the high number of iterations.
BUG=webp:382,webp:512
Change-Id: Icde3e98a58e9ee89604a72fafda30ab71060dec5
(cherry picked from commit af0e4fbb0669026659983691a15dad23a9f196c1)
(cherry picked from commit 4b282e13ad0cf7f1a3b4431788bddef1d6b11762)
+ simplification of the logic
Change-Id: Ia20ce844793ed35ea03a17cef45838f3d0ae4afa
(cherry picked from commit 3b07d32712145bab4eef8dbe4f51650f5e4105a0)
only supported ones are: RGBA/BGRA/rgbA/bgrA (decoder)
as well as: WebPPictureImportRGB/RGBX/RGBA (encoder).
(note: extras/get_disto is affected too)
Change-Id: If6c4f95054ca15759c4e289fb3b4c352b3521c2c
(cherry picked from commit 6de20df02c63b88f408f4b6f52830db339dfdd04)
this results in flickering with animated webp + alpha. disabling the
option is a workaround to restore the behavior to the previous release.
BUG=webp:365
Change-Id: Iac7fcc0d483837e76cc54ad3f26c4e0e5511e31d
remove auto-filter (-af) support and make WebPPictureCopy,
WebPPictureIsView, WebPPictureView, WebPPictureCrop, and
WebPPictureRescale noops.
Change-Id: If39d512cc268a0015298a1138dbc94feb86575e5
with gcc-4.8, clang-4.0.1/5 this is no faster (actually up to 2x slower)
than the code generated for memset (0x01010... * dst[-1]). shuffles in
sse4 recover a bit, but performance is still down.
Change-Id: Ie85e8353f8ede559d0b05a1d388787fd18ecc80f
