libwebp: upstream canvas size check cherry-picks

third_party/libwebp/dec/webp.c

Index: third_party/libwebp/dec/webp.c
diff --git a/third_party/libwebp/dec/webp.c b/third_party/libwebp/dec/webp.c
index 97e79b64da50b03497c23afdcadac1f9fc54375b..e4fe73dc0a8bd8f9b8f29069977a8937ddcfc389 100644
--- a/third_party/libwebp/dec/webp.c
+++ b/third_party/libwebp/dec/webp.c
@@ -286,6 +286,10 @@ static VP8StatusCode ParseHeadersInternal(const uint8_t* data,
                                           int* const has_alpha,
                                           int* const has_animation,
                                           WebPHeaderStructure* const headers) {
+  int canvas_width = 0;
+  int canvas_height = 0;
+  int image_width = 0;
+  int image_height = 0;
   int found_riff = 0;
   int found_vp8x = 0;
   VP8StatusCode status;
@@ -308,19 +312,25 @@ static VP8StatusCode ParseHeadersInternal(const uint8_t* data,
   // Skip over VP8X.
   {
     uint32_t flags = 0;
-    status = ParseVP8X(&data, &data_size, &found_vp8x, width, height, &flags);
+    int animation_present;
+    status = ParseVP8X(&data, &data_size, &found_vp8x,
+                       &canvas_width, &canvas_height, &flags);
     if (status != VP8_STATUS_OK) {
       return status;  // Wrong VP8X / insufficient data.
     }
+    animation_present = !!(flags & ANIMATION_FLAG);
     if (!found_riff && found_vp8x) {
       // Note: This restriction may be removed in the future, if it becomes
       // necessary to send VP8X chunk to the decoder.
       return VP8_STATUS_BITSTREAM_ERROR;
     }
     if (has_alpha != NULL) *has_alpha = !!(flags & ALPHA_FLAG);
-    if (has_animation != NULL) *has_animation = !!(flags & ANIMATION_FLAG);
-    if (found_vp8x && headers == NULL) {
-      return VP8_STATUS_OK;  // Return features from VP8X header.
+    if (has_animation != NULL) *has_animation = animation_present;
+
+    if (found_vp8x && animation_present && headers == NULL) {
+      if (width != NULL) *width = canvas_width;
+      if (height != NULL) *height = canvas_height;
+      return VP8_STATUS_OK;  // Just return features from VP8X header.
     }
   }
 
@@ -351,8 +361,8 @@ static VP8StatusCode ParseHeadersInternal(const uint8_t* data,
       return VP8_STATUS_NOT_ENOUGH_DATA;
     }
     // Validates raw VP8 data.
-    if (!VP8GetInfo(data, data_size,
-                    (uint32_t)hdrs.compressed_size, width, height)) {
+    if (!VP8GetInfo(data, data_size, (uint32_t)hdrs.compressed_size,
+                    &image_width, &image_height)) {
       return VP8_STATUS_BITSTREAM_ERROR;
     }
   } else {
@@ -360,11 +370,18 @@ static VP8StatusCode ParseHeadersInternal(const uint8_t* data,
       return VP8_STATUS_NOT_ENOUGH_DATA;
     }
     // Validates raw VP8L data.
-    if (!VP8LGetInfo(data, data_size, width, height, has_alpha)) {
+    if (!VP8LGetInfo(data, data_size, &image_width, &image_height, has_alpha)) {
       return VP8_STATUS_BITSTREAM_ERROR;
     }
   }
-
+  // Validates image size coherency. TODO(urvang): what about FRGM?
+  if (found_vp8x) {
+    if (canvas_width != image_width || canvas_height != image_height) {
+      return VP8_STATUS_BITSTREAM_ERROR;
+    }
+  }
+  if (width != NULL) *width = image_width;
+  if (height != NULL) *height = image_height;
   if (has_alpha != NULL) {
     // If the data did not contain a VP8X/VP8L chunk the only definitive way
     // to set this is by looking for alpha data (from an ALPH chunk).