Fix OOB write in BuildHuffmanTable.

First, BuildHuffmanTable is called to check if the data is valid. If it is and the table is not big enough, more memory is allocated. This will make sure that valid (but unoptimized because of unbalanced codes) streams are still decodable. Bug: chromium:1479274 Change-Id: I31c36dbf3aa78d35ecf38706b50464fd3d375741 (cherry picked from commit 902bc91903) (cherry picked from commit 2af26267cd)
Merge "lossless: fix crunch mode w/WEBP_REDUCE_SIZE" into main
2025-12-24 14:06:27 +01:00 · 2023-09-07 18:13:52 -07:00 · 2022-07-21 16:27:38 +00:00 · 2022-07-20 22:04:34 -07:00 · 2022-07-20 10:36:23 -07:00 · 2022-07-15 16:00:00 -07:00
21 changed files with 43 additions and 66 deletions
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -509,19 +509,18 @@ endif()

 if(WEBP_BUILD_LIBWEBPMUX)
  parse_makefile_am(${CMAKE_CURRENT_SOURCE_DIR}/src/mux "WEBP_MUX_SRCS" "")
-  add_library(libwebpmux ${WEBP_MUX_SRCS})
-  target_link_libraries(libwebpmux webp)
-  target_include_directories(libwebpmux
+  add_library(webpmux ${WEBP_MUX_SRCS})
+  target_link_libraries(webpmux webp)
+  target_include_directories(webpmux
                             PRIVATE ${CMAKE_CURRENT_BINARY_DIR}
                                     ${CMAKE_CURRENT_SOURCE_DIR})
-  set_version(mux/Makefile.am libwebpmux webpmux)
-  set_target_properties(libwebpmux
+  set_version(mux/Makefile.am webpmux webpmux)
+  set_target_properties(webpmux
                        PROPERTIES PUBLIC_HEADER
                                   "${CMAKE_CURRENT_SOURCE_DIR}/src/webp/mux.h;\
 ${CMAKE_CURRENT_SOURCE_DIR}/src/webp/mux_types.h;\
 ${CMAKE_CURRENT_SOURCE_DIR}/src/webp/types.h;")
-  set_target_properties(libwebpmux PROPERTIES OUTPUT_NAME webpmux)
-  list(APPEND INSTALLED_LIBRARIES libwebpmux)
+  list(APPEND INSTALLED_LIBRARIES webpmux)
  configure_pkg_config("src/mux/libwebpmux.pc")
 endif()

@@ -535,7 +534,7 @@ if(WEBP_BUILD_GIF2WEBP)
                        exampleutil
                        imageioutil
                        webp
-                        libwebpmux
+                        webpmux
                        ${WEBP_DEP_GIF_LIBRARIES})
  target_include_directories(gif2webp PRIVATE ${CMAKE_CURRENT_BINARY_DIR}/src)
  install(TARGETS gif2webp RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
@@ -552,7 +551,7 @@ if(WEBP_BUILD_IMG2WEBP)
                        imagedec
                        imageioutil
                        webp
-                        libwebpmux)
+                        webpmux)
  target_include_directories(img2webp PRIVATE ${CMAKE_CURRENT_BINARY_DIR}/src)
  install(TARGETS img2webp RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
 endif()
@@ -602,10 +601,12 @@ if(WEBP_BUILD_WEBPMUX)
  # webpmux
  parse_makefile_am(${CMAKE_CURRENT_SOURCE_DIR}/examples "WEBPMUX_SRCS"
                    "webpmux")
-  add_executable(webpmux ${WEBPMUX_SRCS})
-  target_link_libraries(webpmux exampleutil imageioutil libwebpmux webp)
-  target_include_directories(webpmux PRIVATE ${CMAKE_CURRENT_BINARY_DIR}/src)
-  install(TARGETS webpmux RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
+  add_executable(webpmux_app ${WEBPMUX_SRCS})
+  set_target_properties(webpmux_app PROPERTIES OUTPUT_NAME webpmux)
+  target_link_libraries(webpmux_app exampleutil imageioutil webpmux webp)
+  target_include_directories(webpmux_app
+                             PRIVATE ${CMAKE_CURRENT_BINARY_DIR}/src)
+  install(TARGETS webpmux_app RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
 endif()

 if(WEBP_BUILD_EXTRAS)
@@ -737,10 +738,6 @@ write_basic_package_version_file(

 # Create the Config file.
 include(CMakePackageConfigHelpers)
-# Fix libwebpmux reference. The target name libwebpmux is used for
-# compatibility purposes, but the library mentioned in WebPConfig.cmake should
-# be the unprefixed version.
-list(TRANSFORM INSTALLED_LIBRARIES REPLACE "libwebpmux" "webpmux")
 configure_package_config_file(
  ${CMAKE_CURRENT_SOURCE_DIR}/cmake/WebPConfig.cmake.in
  ${CMAKE_CURRENT_BINARY_DIR}/WebPConfig.cmake
--- a/6
+++ b/6
@@ -1,9 +1,3 @@
-980d2488 update NEWS
-9fde8127 bump version to 1.2.4
-e626925c lossless: fix crunch mode w/WEBP_REDUCE_SIZE
-bfad7ab5 CMakeLists.txt: correct libwebpmux name in WebPConfig.cmake
-c2e3fd30 Revert "cmake: fix webpmux lib name for cmake linking"
-3c4a0fbf update ChangeLog (tag: v1.2.3)
 56a480e8 dsp/cpu.h: add missing extern "C"
 62b45bdd update ChangeLog (tag: v1.2.3-rc1)
 8764ec7a Merge changes Idb037953,Id582e395 into 1.2.3
--- a/6
+++ b/6
@@ -1,9 +1,3 @@
- 8/4/2022: version 1.2.4
-  This is a binary compatible release.
-  * restore CMake libwebpmux target name for compatibility with 1.2.2 (#575)
-  * fix lossless crunch mode encoding with WEBP_REDUCE_SIZE
-    (chromium: #1345547, #1345595, #1345772, #1345804)
-
 - 6/30/2022: version 1.2.3
  This is a binary compatible release.
  * security fix for lossless encoder (#565, chromium:1313709)
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@
      \__\__/\____/\_____/__/ ____  ___
            / _/ /    \    \ /  _ \/ _/
           /  \_/   / /   \ \   __/  \__
-           \____/____/\_____/_____/____/v1.2.4
+           \____/____/\_____/_____/____/v1.2.3
 ```

 WebP codec is a library to encode and decode images in WebP format. This package
--- a/cmake/WebPConfig.cmake.in
+++ b/cmake/WebPConfig.cmake.in
@@ -3,11 +3,6 @@ set(WEBP_VERSION ${WebP_VERSION})

@PACKAGE_INIT@

-if(@WEBP_USE_THREAD@)
-  include(CMakeFindDependencyMacro)
-  find_dependency(Threads REQUIRED)
-endif()
-
 include ("${CMAKE_CURRENT_LIST_DIR}/@PROJECT_NAME@Targets.cmake")

 set(WebP_INCLUDE_DIRS "@CMAKE_INSTALL_FULL_INCLUDEDIR@")
--- a/configure.ac
+++ b/configure.ac
@@ -1,4 +1,4 @@
-AC_INIT([libwebp], [1.2.4],
+AC_INIT([libwebp], [1.2.3],
        [https://bugs.chromium.org/p/webp],,
        [https://developers.google.com/speed/webp])
 AC_CANONICAL_HOST
--- a/doc/webp-lossless-bitstream-spec.txt
+++ b/doc/webp-lossless-bitstream-spec.txt
@@ -634,7 +634,7 @@ We use image data in five different roles:
     [Color Indexing Transform](#color-indexing-transform). This is stored as an
     image of width `color_table_size` and height `1`.

-### 4.2 Encoding of Image data
+### 4.2 Encoding of Image Data

 The encoding of image data is independent of its role.

--- a/extras/extras.c
+++ b/extras/extras.c
@@ -19,7 +19,7 @@

 #define XTRA_MAJ_VERSION 1
 #define XTRA_MIN_VERSION 2
-#define XTRA_REV_VERSION 4
+#define XTRA_REV_VERSION 3

 //------------------------------------------------------------------------------

--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -36,7 +36,7 @@ libwebp_la_LIBADD += utils/libwebputils.la
 # other than the ones listed on the command line, i.e., after linking, it will
 # not have unresolved symbols. Some platforms (Windows among them) require all
 # symbols in shared libraries to be resolved at library creation.
-libwebp_la_LDFLAGS = -no-undefined -version-info 8:5:1
+libwebp_la_LDFLAGS = -no-undefined -version-info 8:4:1
 libwebpincludedir = $(includedir)/webp
 pkgconfig_DATA = libwebp.pc

@@ -48,7 +48,7 @@ if BUILD_LIBWEBPDECODER
  libwebpdecoder_la_LIBADD += dsp/libwebpdspdecode.la
  libwebpdecoder_la_LIBADD += utils/libwebputilsdecode.la

-  libwebpdecoder_la_LDFLAGS = -no-undefined -version-info 4:5:1
+  libwebpdecoder_la_LDFLAGS = -no-undefined -version-info 4:4:1
  pkgconfig_DATA += libwebpdecoder.pc
 endif

--- a/src/dec/vp8i_dec.h
+++ b/src/dec/vp8i_dec.h
@@ -32,7 +32,7 @@ extern "C" {
 // version numbers
 #define DEC_MAJ_VERSION 1
 #define DEC_MIN_VERSION 2
-#define DEC_REV_VERSION 4
+#define DEC_REV_VERSION 3

 // YUV-cache parameters. Cache is 32-bytes wide (= one cacheline).
 // Constraints are: We need to store one 16x16 block of luma samples (y),
--- a/src/demux/Makefile.am
+++ b/src/demux/Makefile.am
@@ -13,6 +13,6 @@ noinst_HEADERS =
 noinst_HEADERS += ../webp/format_constants.h

 libwebpdemux_la_LIBADD = ../libwebp.la
-libwebpdemux_la_LDFLAGS = -no-undefined -version-info 2:11:0
+libwebpdemux_la_LDFLAGS = -no-undefined -version-info 2:10:0
 libwebpdemuxincludedir = $(includedir)/webp
 pkgconfig_DATA = libwebpdemux.pc
--- a/src/demux/demux.c
+++ b/src/demux/demux.c
@@ -25,7 +25,7 @@

 #define DMUX_MAJ_VERSION 1
 #define DMUX_MIN_VERSION 2
-#define DMUX_REV_VERSION 4
+#define DMUX_REV_VERSION 3

 typedef struct {
  size_t start_;        // start location of the data
--- a/src/demux/libwebpdemux.rc
+++ b/src/demux/libwebpdemux.rc
@@ -6,8 +6,8 @@
 LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US

 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,0,2,4
- PRODUCTVERSION 1,0,2,4
+ FILEVERSION 1,0,2,3
+ PRODUCTVERSION 1,0,2,3
 FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
 FILEFLAGS 0x1L
@@ -24,12 +24,12 @@ BEGIN
        BEGIN
            VALUE "CompanyName", "Google, Inc."
            VALUE "FileDescription", "libwebpdemux DLL"
-            VALUE "FileVersion", "1.2.4"
+            VALUE "FileVersion", "1.2.3"
            VALUE "InternalName", "libwebpdemux.dll"
            VALUE "LegalCopyright", "Copyright (C) 2022"
            VALUE "OriginalFilename", "libwebpdemux.dll"
            VALUE "ProductName", "WebP Image Demuxer"
-            VALUE "ProductVersion", "1.2.4"
+            VALUE "ProductVersion", "1.2.3"
        END
    END
    BLOCK "VarFileInfo"
--- a/src/enc/alpha_enc.c
+++ b/src/enc/alpha_enc.c
@@ -13,7 +13,6 @@

 #include <assert.h>
 #include <stdlib.h>
-#include <string.h>

 #include "src/enc/vp8i_enc.h"
 #include "src/dsp/dsp.h"
@@ -149,7 +148,6 @@ static int EncodeAlphaInternal(const uint8_t* const data, int width, int height,
      }
    } else {
      VP8LBitWriterWipeOut(&tmp_bw);
-      memset(&result->bw, 0, sizeof(result->bw));
      return 0;
    }
  }
@@ -164,7 +162,7 @@ static int EncodeAlphaInternal(const uint8_t* const data, int width, int height,
  header = method | (filter << 2);
  if (reduce_levels) header |= ALPHA_PREPROCESSED_LEVELS << 4;

-  if (!VP8BitWriterInit(&result->bw, ALPHA_HEADER_LEN + output_size)) ok = 0;
+  VP8BitWriterInit(&result->bw, ALPHA_HEADER_LEN + output_size);
  ok = ok && VP8BitWriterAppend(&result->bw, &header, ALPHA_HEADER_LEN);
  ok = ok && VP8BitWriterAppend(&result->bw, output, output_size);

--- a/src/enc/vp8i_enc.h
+++ b/src/enc/vp8i_enc.h
@@ -32,7 +32,7 @@ extern "C" {
 // version numbers
 #define ENC_MAJ_VERSION 1
 #define ENC_MIN_VERSION 2
-#define ENC_REV_VERSION 4
+#define ENC_REV_VERSION 3

 enum { MAX_LF_LEVELS = 64,       // Maximum loop filter level
       MAX_VARIABLE_LEVEL = 67,  // last (inclusive) level with variable cost
--- a/src/enc/vp8l_enc.c
+++ b/src/enc/vp8l_enc.c
@@ -259,7 +259,6 @@ static int PaletteSortModifiedZeng(
    return 0;
  }
  if (!CoOccurrenceBuild(pic, palette_sorted, num_colors, cooccurrence)) {
-    WebPSafeFree(cooccurrence);
    return 0;
  }

--- a/src/libwebp.rc
+++ b/src/libwebp.rc
@@ -6,8 +6,8 @@
 LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US

 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,0,2,4
- PRODUCTVERSION 1,0,2,4
+ FILEVERSION 1,0,2,3
+ PRODUCTVERSION 1,0,2,3
 FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
 FILEFLAGS 0x1L
@@ -24,12 +24,12 @@ BEGIN
        BEGIN
            VALUE "CompanyName", "Google, Inc."
            VALUE "FileDescription", "libwebp DLL"
-            VALUE "FileVersion", "1.2.4"
+            VALUE "FileVersion", "1.2.3"
            VALUE "InternalName", "libwebp.dll"
            VALUE "LegalCopyright", "Copyright (C) 2022"
            VALUE "OriginalFilename", "libwebp.dll"
            VALUE "ProductName", "WebP Image Codec"
-            VALUE "ProductVersion", "1.2.4"
+            VALUE "ProductVersion", "1.2.3"
        END
    END
    BLOCK "VarFileInfo"
--- a/src/libwebpdecoder.rc
+++ b/src/libwebpdecoder.rc
@@ -6,8 +6,8 @@
 LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US

 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,0,2,4
- PRODUCTVERSION 1,0,2,4
+ FILEVERSION 1,0,2,3
+ PRODUCTVERSION 1,0,2,3
 FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
 FILEFLAGS 0x1L
@@ -24,12 +24,12 @@ BEGIN
        BEGIN
            VALUE "CompanyName", "Google, Inc."
            VALUE "FileDescription", "libwebpdecoder DLL"
-            VALUE "FileVersion", "1.2.4"
+            VALUE "FileVersion", "1.2.3"
            VALUE "InternalName", "libwebpdecoder.dll"
            VALUE "LegalCopyright", "Copyright (C) 2022"
            VALUE "OriginalFilename", "libwebpdecoder.dll"
            VALUE "ProductName", "WebP Image Decoder"
-            VALUE "ProductVersion", "1.2.4"
+            VALUE "ProductVersion", "1.2.3"
        END
    END
    BLOCK "VarFileInfo"
--- a/src/mux/Makefile.am
+++ b/src/mux/Makefile.am
@@ -17,6 +17,6 @@ noinst_HEADERS =
 noinst_HEADERS += ../webp/format_constants.h

 libwebpmux_la_LIBADD = ../libwebp.la
-libwebpmux_la_LDFLAGS = -no-undefined -version-info 3:10:0 -lm
+libwebpmux_la_LDFLAGS = -no-undefined -version-info 3:9:0 -lm
 libwebpmuxincludedir = $(includedir)/webp
 pkgconfig_DATA = libwebpmux.pc
--- a/src/mux/libwebpmux.rc
+++ b/src/mux/libwebpmux.rc
@@ -6,8 +6,8 @@
 LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US

 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,0,2,4
- PRODUCTVERSION 1,0,2,4
+ FILEVERSION 1,0,2,3
+ PRODUCTVERSION 1,0,2,3
 FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
 FILEFLAGS 0x1L
@@ -24,12 +24,12 @@ BEGIN
        BEGIN
            VALUE "CompanyName", "Google, Inc."
            VALUE "FileDescription", "libwebpmux DLL"
-            VALUE "FileVersion", "1.2.4"
+            VALUE "FileVersion", "1.2.3"
            VALUE "InternalName", "libwebpmux.dll"
            VALUE "LegalCopyright", "Copyright (C) 2022"
            VALUE "OriginalFilename", "libwebpmux.dll"
            VALUE "ProductName", "WebP Image Muxer"
-            VALUE "ProductVersion", "1.2.4"
+            VALUE "ProductVersion", "1.2.3"
        END
    END
    BLOCK "VarFileInfo"
--- a/src/mux/muxi.h
+++ b/src/mux/muxi.h
@@ -29,7 +29,7 @@ extern "C" {

 #define MUX_MAJ_VERSION 1
 #define MUX_MIN_VERSION 2
-#define MUX_REV_VERSION 4
+#define MUX_REV_VERSION 3

 // Chunk object.
 typedef struct WebPChunk WebPChunk;
Author	SHA1	Message	Date
Vincent Rabaud	0aba549eb6	Fix OOB write in BuildHuffmanTable. First, BuildHuffmanTable is called to check if the data is valid. If it is and the table is not big enough, more memory is allocated. This will make sure that valid (but unoptimized because of unbalanced codes) streams are still decodable. Bug: chromium:1479274 Change-Id: I31c36dbf3aa78d35ecf38706b50464fd3d375741 (cherry picked from commit `902bc91903`) (cherry picked from commit `2af26267cd`)	2023-09-07 18:13:52 -07:00
James Zern	7366f7f394	Merge "lossless: fix crunch mode w/WEBP_REDUCE_SIZE" into main	2022-07-21 16:27:38 +00:00
James Zern	84163d9d02	lossless: fix crunch mode w/WEBP_REDUCE_SIZE WEBP_REDUCE_SIZE was introduced to bring down the library size by removing cropping and scaling support. Previously WebPPictureView() was only used with these two, but in `ec178f2c` Add progress hook granularity in lossless an additional use was added in VP8LEncodeStream() when extra side configurations are used in crunch mode (-mt, quality == 100 & method == 6 or quality >= 75 & method == 5 with a palette present currently). WebPPictureView() and, for coherency, WebPPictureIsView() are restored in this configuration to avoid affecting the general encode path. Previously WebPPictureView() was assumed to always succeed in these cases which could result in crashes with WEBP_REDUCE_SIZE defined. Bug: chromium:1345547 Bug: chromium:1345595 Bug: chromium:1345772 Bug: chromium:1345804 Change-Id: Ifecde36a726a434510478a764514b1469942c684	2022-07-20 22:04:34 -07:00
James Zern	d01c1eb309	webp-lossless-bitstream-spec,cosmetics: normalize capitalization in section headings Change-Id: I43b2208f5e0efa32029d519ac9805e871eb51ed3	2022-07-20 10:36:23 -07:00
James Zern	8813ca8e69	Merge tag 'v1.2.3' libwebp-1.2.3 - 6/30/2022: version 1.2.3 This is a binary compatible release. * security fix for lossless encoder (#565, chromium:1313709) * improved progress granularity in WebPReportProgress() when using lossless * improved precision in Sharp YUV (-sharp_yuv) conversion * many corrections to webp-lossless-bitstream-spec.txt (#551) * crash/leak fixes on error/OOM and other bug fixes (#558, #563, #569, #573) Bug: webp:568 Bug: b/230421671 * tag 'v1.2.3': update ChangeLog dsp/cpu.h: add missing extern "C" update ChangeLog vwebp: fix file name display in windows unicode build webpmux: fix -frame option in windows unicode build makefile.unix: add sharpyuv objects to clean target update NEWS bump version to 1.2.3 update AUTHORS update .mailmap Change-Id: I148041862bc930472e849d278471aa17ea12258b	2022-07-15 16:00:00 -07:00