Bring in fix for Chrome's 157079.
The upstream fix is at https://chromiumcodereview.appspot.com/11229048
Change-Id: I98a7c55e4fe01f679233df1ad2316f0f7833c923
diff --git a/src/dec/webp.c b/src/dec/webp.c
index 54cb6d3..1edf6d9 100644
--- a/src/dec/webp.c
+++ b/src/dec/webp.c
@@ -76,6 +76,9 @@
if (size < TAG_SIZE + CHUNK_HEADER_SIZE) {
return VP8_STATUS_BITSTREAM_ERROR;
}
+ if (size > MAX_CHUNK_PAYLOAD) {
+ return VP8_STATUS_BITSTREAM_ERROR;
+ }
// We have a RIFF container. Skip it.
*riff_size = size;
*data += RIFF_HEADER_SIZE;
@@ -177,6 +180,9 @@
}
chunk_size = get_le32(buf + TAG_SIZE);
+ if (chunk_size > MAX_CHUNK_PAYLOAD) {
+ return VP8_STATUS_BITSTREAM_ERROR; // Not a valid chunk size.
+ }
// For odd-sized chunk-payload, there's one byte padding at the end.
disk_chunk_size = (CHUNK_HEADER_SIZE + chunk_size + 1) & ~1;
total_size += disk_chunk_size;
