libwebp: validate chunk size in ParseOptionalChunks

third_party/libwebp/dec/webp.c

 // Copyright 2010 Google Inc. All Rights Reserved.
 //
 // This code is licensed under the same terms as WebM:
 //  Software License Agreement:  http://www.webmproject.org/license/software/
 //  Additional IP Rights Grant:  http://www.webmproject.org/license/additional/
 // -----------------------------------------------------------------------------
 //
 // Main decoding functions for WEBP images.
 //
 // Author: Skal (pascal.massimino@gmail.com)
@@ skipping 58 matching lines @@
   *riff_size = 0;  // Default: no RIFF present.
   if (*data_size >= RIFF_HEADER_SIZE && !memcmp(*data, "RIFF", TAG_SIZE)) {
     if (memcmp(*data + 8, "WEBP", TAG_SIZE)) {
       return VP8_STATUS_BITSTREAM_ERROR;  // Wrong image file signature.
     } else {
       const uint32_t size = get_le32(*data + TAG_SIZE);
       // Check that we have at least one chunk (i.e "WEBP" + "VP8?nnnn").
       if (size < TAG_SIZE + CHUNK_HEADER_SIZE) {
         return VP8_STATUS_BITSTREAM_ERROR;
       }
+      if (size > MAX_CHUNK_PAYLOAD) {
+        return VP8_STATUS_BITSTREAM_ERROR;
+      }
       // We have a RIFF container. Skip it.
       *riff_size = size;
       *data += RIFF_HEADER_SIZE;
       *data_size -= RIFF_HEADER_SIZE;
     }
   }
   return VP8_STATUS_OK;
 }
 
 // Validates the VP8X header and skips over it.
@@ skipping 81 matching lines @@
     uint32_t disk_chunk_size;   // chunk_size with padding
 
     *data = buf;
     *data_size = buf_size;
 
     if (buf_size < CHUNK_HEADER_SIZE) {  // Insufficient data.
       return VP8_STATUS_NOT_ENOUGH_DATA;
     }
 
     chunk_size = get_le32(buf + TAG_SIZE);
+    if (chunk_size > MAX_CHUNK_PAYLOAD) {
+      return VP8_STATUS_BITSTREAM_ERROR;          // Not a valid chunk size.

[fbarchard, 2012/10/23 19:05:05]

nit Should be 2 spaces before comment.
return VP8_STATUS_BITSTREAM_ERROR;  // Not a valid chunk size.

[jzern, 2012/10/23 19:23:22]

This is consistent to the remainder of the function. any cosmetics can be done
upstream...

+    }
     // For odd-sized chunk-payload, there's one byte padding at the end.
     disk_chunk_size = (CHUNK_HEADER_SIZE + chunk_size + 1) & ~1;
     total_size += disk_chunk_size;
 
     // Check that total bytes skipped so far does not exceed riff_size.
     if (riff_size > 0 && (total_size > riff_size)) {
       return VP8_STATUS_BITSTREAM_ERROR;          // Not a valid chunk size.
     }
 
     if (buf_size < disk_chunk_size) {             // Insufficient data.
@@ skipping 572 matching lines @@
     io->fancy_upsampling = 0;
   }
   return 1;
 }
 
 //------------------------------------------------------------------------------
 
 #if defined(__cplusplus) || defined(c_plusplus)
 }    // extern "C"
 #endif