Merge "Properly check the data size against the end of the RIFF chunk" into main

Properly check the data size against the end of the RIFF chunk
Bug: oss-fuzz:382816119 Change-Id: I629870246d8f1bd7c6cb0d66e89018600cecee3a
2024-12-25 13:18:22 +01:00 · 2024-12-10 08:10:16 +00:00 · 2024-12-10 09:09:08 +01:00
1 changed files with 2 additions and 0 deletions
--- a/src/mux/muxread.c
+++ b/src/mux/muxread.c
@ -223,6 +223,8 @@ WebPMux* WebPMuxCreateInternal(const WebPData* bitstream, int copy_data,
  // Note this padding is historical and differs from demux.c which does not
  // pad the file size.
  riff_size = SizeWithPadding(riff_size);
+  // Make sure the whole RIFF header is available.
+  if (riff_size < RIFF_HEADER_SIZE) goto Err;
  if (riff_size > size) goto Err;
  // There's no point in reading past the end of the RIFF chunk. Note riff_size
  // includes CHUNK_HEADER_SIZE after SizeWithPadding().
Author	SHA1	Message	Date
Vincent Rabaud	1b4c967fbb	Merge "Properly check the data size against the end of the RIFF chunk" into main	2024-12-10 08:10:16 +00:00
Vincent Rabaud	9e5ecfaf00	Properly check the data size against the end of the RIFF chunk Bug: oss-fuzz:382816119 Change-Id: I629870246d8f1bd7c6cb0d66e89018600cecee3a	2024-12-10 09:09:08 +01:00