Commit Graph

3161 Commits

Author SHA1 Message Date
bc99ef0699 Limit memory allocation when reading invalid Huffman codes.
This is a backported fix for: CVE-2020-36332

This is a merge of:
dce5d76431
39cb9aad85
067031eaed

Change-Id: Iab84d2ca459327cdcee1038499842d30370fe486
2023-10-06 11:53:40 +02:00
ece9684f52 update ChangeLog
Change-Id: I0d8730f3f5fb0b54404666bc0088fe29a3e55fc4
v0.5.2 v0.5.2-rc2
2016-12-15 15:44:21 -08:00
aa7744ca38 anim_util: quiet implicit conv warnings in 32-bit
the sizes are already validated by CheckSizeForOverflow(), add casts to
size_t to avoid -Wshorten-64-to-32

Change-Id: Ida9102c2104f4a334a0ad16d6e01a12bedfd4eec
(cherry picked from commit 1e2e25b0d4)
2016-12-15 11:51:44 -08:00
d9120271e7 jpegdec: correct ContextFill signature
fill_input_buffer returns a boolean

Change-Id: I208a1a862fa6c57cb5b73568b84055f734c1c36f
(cherry picked from commit cec7201447)
2016-12-15 11:51:28 -08:00
24eb39401b Remove some errors when compiling the code as C++.
This fixes some cases from
https://bugs.chromium.org/p/webp/issues/detail?id=137

Change-Id: I58f3a617bf973dbe4c5794004a01e2aea39ba53a
(cherry picked from commit 28ce304344)
2016-12-15 11:50:44 -08:00
a4a8e5f32c vwebp: clear canvas during resize w/o animation
this corrects the checkboard pattern displayed with transparent images

Change-Id: I5f46dbc9fa3893d61f5f1d4fda643ac030238f94
(cherry picked from commit 67c25ad5b4)
2016-12-14 11:26:24 -08:00
31ca2a8098 tiffdec: restore libtiff 3.9.x compatibility
use tsize_t which is equivalent (for now) to tmsize_t added in version 4

Change-Id: I7489ef7b39d9a3692a4b952de22476b245240ed1
2016-12-13 22:50:28 -08:00
b2f77b57a9 update NEWS
Change-Id: Ie74e9331378a254cc2265eaa1c94101db767e411
2016-12-13 18:51:20 -08:00
5ab6d9de1f AnimEncoder: avoid freeing uninitialized memory pointer.
In GenerateCandidates(), when candidate_ll->evaluate_ and
candidate_lossy->evaluate_ are both true, if lossless encoding
exits on error, candidate_ll->evaluate_ would not be correctly
reset. This will cause freeing uninitialized memory pointer in
SetFrame().

BUG=webp:322

Change-Id: I481b49a186e4fa3607ce71b4543a481083edf444
(cherry picked from commit 3ebe1c0003)
2016-12-13 18:18:57 -08:00
f29bf582df WebPAnimEncoder: If 'minimize_size' and 'allow_mixed' on, try lossy + lossless.
This improves compression by ~5% at default quality.

If only 'allow_mixed' is on (but 'minimize_size' isn't), we continue to
use a heuristic to try one of the two or both.

Change-Id: Ia573a73ea26ad25f9debff759eed69d2b0449e82
(cherry picked from commit 3f4042b52a)
2016-12-13 18:18:48 -08:00
df780e0eac fix a potential overflow with MALLOC_LIMIT
BUG=webp:321

Change-Id: Iab89dfe167fb394fcdffd3b2732d4ac9bef764b0
(cherry picked from commit 76bbcf2ed6)
2016-12-13 16:15:28 -08:00
218460cdd7 bump version to 0.5.2
libwebp{,decoder} - 0.5.2
libwebp libtool - 6.2.0
libwebpdecoder libtool - 2.2.0

mux - 0.3.2
libtool - 2.2.0

demux - 0.3.1
libtool - 2.1.0

Change-Id: Idf199415c325e6e9d157459a4e016ebba88c3f34
2016-12-12 17:36:12 -08:00
de7d654d0d update AUTHORS & .mailmap
Change-Id: If4d71ede51f91959e4990f3455c781a8bcf4d373
2016-12-12 17:36:09 -08:00
74a12b10d9 iosbuild.sh: add WebPDecoder.framework + encoder
WebPDecoder.framework replaces WebP.framework as the decode-only
framework.
WebP.framework now includes the full library allowing for use of the
encoder.

BUG=webp:307

Change-Id: Ic8139f201576bf94b0d4a31cb7cad0655cd8ba97
(cherry picked from commit 1d5046d1f9)
2016-12-12 12:50:49 -08:00
be7dcc088c AnimEncoder: Correctly skip a frame when sub-rectangle is empty.
Change-Id: I0d288bd9561b48cf5a1eae92a1b7106ba44c664e
(cherry picked from commit 1cc79e92ac)
2016-12-09 20:22:31 -08:00
408858308a Fix assertions in WebPRescalerExportRow()
Change-Id: I25711dd54e71c90a25f7b18e0ef9155e8151a15e
(cherry picked from commit 27b5d991e2)
2016-12-09 20:22:25 -08:00
8f38c72e11 fix a typo in WebPPictureYUVAToARGB's doc
method -> colorspace

Change-Id: I5c9a2ccc909c967a936758dde2cfce92eb95462a
(cherry picked from commit dc789ada44)
2016-12-09 17:27:59 -08:00
33ca93f909 systematically call WebPDemuxReleaseIterator() on dec->prev_iter_
Change-Id: I4a767134dcc52a7ee7c3bc5deb91012eaf7b6512
(cherry picked from commit aaf2a6a698)
2016-12-09 17:27:54 -08:00
76e190735b doc: use two's complement explicitly for uint8->int8 conversion
BUG=webp:225

Change-Id: I6bad131e275dbd992484e95a1b834010121281b8
(cherry picked from commit 13ae011e4c)
2016-12-09 17:27:50 -08:00
f91ba96306 Anim_encoder: correctly handle enc->prev_candidate_undecided_
Set enc->prev_candidate_undecided_ as 0 when a frame is not chosen
as a possible keyframe, so that the dispose method can be
dispose-to-background.

Change-Id: If2899f5dbc06fb53705fb8240072ab6440a6de12
(cherry picked from commit 29fedbf58b)
2016-12-09 16:58:28 -08:00
25d74e652e WebPPictureDistortion(): free() -> WebPSafeFree()
missed one!

Change-Id: I643170451b3ac07c748b70a9abfe8af17a716b24
(cherry picked from commit 32dead4ee3)
2016-12-09 16:58:19 -08:00
03f1c00877 mux/Makefile.am: add missing -lm
+ libwebpmux.pc

anim_encode.c relies on functions from math.h

BUG=webp:306

Change-Id: I3a8eb48febfd52bfbeb04f4dc615ccbed72926f7
(cherry picked from commit aaf2530cc3)
2016-12-09 15:03:08 -08:00
58410cd6dc fix bug in RefineUsingDistortion()
When try_both_modes=0 (that is: -m 0 or -m 1), and the mode is i4,
we were still sometimes falling back to (unexplored, uninitialized) i16 mode,
which resulted in a enc/dec mismatch.
This was mainly occurring for large images (when bit_limit is low enough)

We disable the fall-back by disabling bit_limit using a large MAX_COST threshold.

Change-Id: I0c60257595812bd813b239ff4c86703ddf63cbf8
(cherry picked from commit 0a3838ca77)
2016-12-08 15:48:16 -08:00
e168af8c6c fix filtering auto-adjustment
the min-distortion was quite too low. And we were also
considering the fully skipped macroblocks (nz=0) in the stats.
We need to have at least *some* non-zero dc coeffs (nz=0x100XXXX).

Fix also two typos in StoreMaxDelta: the v0/v1 comparison was wrong,
and the DCs[] coeffs are actually already in ZigZag order.

Change-Id: I602aaa74b36f7ce80017e506212c7d6fd9deba1f
(cherry picked from commit e4cd4daf74)
2016-12-08 15:48:08 -08:00
ed9dec41a5 fix doc and code snippet for WebPINewDecoder() doc
Change-Id: I1a75fdf60f0b9f1816be28f22613438bfe21752b
(cherry picked from commit e715285611)
2016-12-08 15:48:04 -08:00
3c49178f7d prevent 32b overflow for very large canvas_width / height
some multiplies here and there needed some extra checks
and error reporting. Even if width * height is guaranteed
to be < 2**32, we were multiplying by num_channels and
triggering a 32b overflow.
Some multiplies were not using size_t or uint64_t, additionally.

Change-Id: If2a35b94c8af204135f4b88a7fd63850aa381bbf
(cherry picked from commit 1c36440094)
2016-12-08 15:27:51 -08:00
9595f29010 fix anim_util.c compilation when HAVE_GIF is not defined.
Change-Id: I1a4f13a5799c020fb4b3ade3c7336f049443ab62
(cherry picked from commit 1effde7bcd)
2016-12-08 15:27:46 -08:00
7ec9552c22 Make gif transparent color to be transparent black
Change it from transparent white to transparent black, which matches
the transparent color assumed in Webp dispose-to-background method.

Also pre-multiply background colors before comparison in anim_diff,
just as what is done with regular pixel values.

Change-Id: I5a790522df21619c666ce499f73e42294ed276f2
(cherry picked from commit 43bd895879)
2016-12-08 15:27:40 -08:00
9871335fc8 Add a CMake option for WEBP_SWAP_16BIT_CSP.
Change-Id: I79ed6cbce9563bf7ca97fc2e10ec3e75b6b8ab5b
(cherry picked from commit 7b54e26bac)
2016-12-07 23:41:36 -08:00
0ae32226ce Fix missing cpu-features for Android.
Change-Id: Ief13b7c63b96194970b00a5732aa080f794e7ae6
(cherry picked from commit d2223d8d6c)
2016-12-07 23:41:28 -08:00
ab4c8056e0 cpu.cmake: improve webp_check_compiler_flag output
WEBP_HAVE_FLAG_LOCAL -> WEBP_HAVE_FLAG_${WEBP_SIMD_FLAG} this will
include the flag being tested in the output:
-- Performing Test WEBP_HAVE_FLAG_NEON

Change-Id: I1c0a143a857b16e4eb1fcf8b23c176380a5fef29
(cherry picked from commit ee1057e3b1)
2016-12-07 23:41:23 -08:00
eec5fa3a95 Provide support for CMake on Android studio 2.2.
Change-Id: Ib3508c20a220b29d42f963cf154cd9ab5236ed6e
(cherry picked from commit a80e8cfdf2)
2016-12-07 23:41:17 -08:00
004d569086 Split the main CMake file.
This will well isolate contributions for original code,
generated code and SIMD (especially for Android).

Change-Id: Ie47664decc7f43c2f57260a72cab951c347281a7
(cherry picked from commit 6c62841076)
2016-12-07 23:41:08 -08:00
4fe5d588bf Android.mk: use -fvisibility=hidden
brings the final libwebp.so size down 16/20K with arm64/armv7 builds
using ndk-r13

Change-Id: I20d8aba61d6b692b0fc32f4b271e2f9872f03c28
(cherry picked from commit de568abfdb)
2016-12-07 18:34:46 -08:00
bd63a31aab vwebp: ensure setenv() is available in stdlib.h
quiets a -Wimplicit-function-declaration with some configurations of gcc
(-std=c99).
_POSIX_C_SOURCE is preferred over _BSD_SOURCE with newer versions of
glibc

Change-Id: I378bffb13ba52ff5c4bad1433090dcc387e5d507
(cherry picked from commit bfab894739)
2016-12-07 18:30:54 -08:00
363a568131 vwebp: handle window resizing properly
The image is scaled to fit the whole viewport.
Avoid some oddities with offsets, etc.

removes some TODO.

Change-Id: I52fae9ca80a2feed234f32261c7f6358d7594e21
(cherry picked from commit 9310d19258)
2016-12-07 18:30:49 -08:00
a0d2753fcb lower WEBP_MAX_ALLOCABLE_MEMORY default
restrict to 2^34 for 64-bit targets, < 2^32 for 32-bit

Change-Id: Iff4ce40ae2c3c7fc119f018c2128dbe8f744341f
(cherry picked from commit b8384b53d6)
2016-12-07 18:30:44 -08:00
31fe11a57a fix infinite loop in case of PARTITION0 overflow
max_i4_header_bits_ could drop to zero for difficult image and trigger
a loop. Surprisingly, StatLoop() didn't have this bug.

Change-Id: Idc0f9eadef30a2b2f02041b994f25def30901e36
(cherry picked from commit 21e7537abe)
2016-12-07 18:30:39 -08:00
532215dd29 Change the rule of picking UV mode in MBAnalyzeBestUVMode()
Pick the mode with the smallest alpha.
It only affects m0, in which case the mode decision is not re-examined
later in VP8Decimate(). Tests on some natural content png images show
PSNR increase as well as visual quality improvement.

Change-Id: Iea997e718cd7477160fa05eb7cfb35f4cec2fa9a
(cherry picked from commit 1377ac2ec1)
2016-12-07 18:30:33 -08:00
9c75dbd39c cwebp.1: improve some grammar
Change-Id: Id849d7e0d7573f5b8d3b2e807d95e9c628f03b1e
(cherry picked from commit 5b46f7fc80)
2016-12-07 18:30:28 -08:00
af2e05cbdf vwebp: Clear previous frame when a key triggers a redraw
otherwise, transparent areas were accumulating.

Change-Id: I066a96a2bcf0cac750b3df0c02229542b1ed3473
(cherry picked from commit c0a27fd2af)
2016-12-07 18:30:23 -08:00
26ffa2962b Add descriptions of default configuration in help info.
Change-Id: I43188fab5f57bd45aa3e564df52e36cc37b1bb2f
(cherry picked from commit 74f6f9e793)
2016-12-07 18:30:17 -08:00
7416280d75 Fix an unsigned integer overflow error in enc/cost.h
Change-Id: I9774b59c417c185f09a61a115364b9642976a100
(cherry picked from commit 0b2c58a91c)
2016-12-07 18:29:51 -08:00
13cf1d2e41 Do token recording and counting in a single loop
Change-Id: I8afd3c486b210bd67888de03e91dde7f78276f89
(cherry picked from commit 0c0fb83211)
2016-12-07 18:29:44 -08:00
eb9a4b97c5 Reset segment id if we decide not to update segment map
This avoids potential encoder and decoder mismatch.

Change-Id: I5282d3e168afc6193033ad3fce8fbc35618ab2f5
(cherry picked from commit 386e4ba2f0)
2016-12-07 18:25:06 -08:00
42ebe3b783 configure: fix NEON flag detection under gcc 6
use a compile check on a separate file to avoid assuming using
arm_neon.h is safe to use without flags when just the file itself is
self-contained with GCC target pragmas.

BUG=webp:313

Change-Id: I48f92ae3e6e4a9468ea5b937c80a89ee40b2dcfd
(cherry picked from commit 0104d730bf)
2016-12-07 18:23:55 -08:00
83cbfa09a1 Import: use relative pointer offsets
avoids int rollover when working with large input

BUG=webp:312

Change-Id: I6ad9f93b6c4b665c559bff87716a7b847f66a20d
(cherry picked from commit 342e15f0ce)
2016-11-09 15:50:57 -08:00
a1ade40ed8 PreprocessARGB: use relative pointer offsets
avoids int rollover when working with large input

BUG=webp:312

Change-Id: I2881bec2884b550c966108beeff1bf0d8ef9f76b
(cherry picked from commit 1147ab4ee7)
2016-11-09 15:24:16 -08:00
fd4d090fd1 ConvertWRGBToYUV: use relative pointer offsets
avoids int rollover when working with large input

BUG=webp:312

Change-Id: I693cbb295df9cf94aa89294b19c0496bdbe84d18
(cherry picked from commit de9fa5074e)
2016-11-09 12:57:03 -08:00
9daad4598b ImportYUVAFromRGBA: use relative pointer offsets
avoids int rollover when working with large input

BUG=webp:312

Change-Id: I3d7b689be8d5751248a82d1021243d80d3f67203
(cherry picked from commit deb1b83199)
2016-11-09 12:56:49 -08:00