libwebp: upstream canvas size check cherry-picks

third_party/libwebp/demux/demux.c

Index: third_party/libwebp/demux/demux.c
diff --git a/third_party/libwebp/demux/demux.c b/third_party/libwebp/demux/demux.c
index bd17ff7f69d39c11ac4d47901d0ef5f77f265a9e..8c2250d660e77ed879197712395d8bb8e556fdfc 100644
--- a/third_party/libwebp/demux/demux.c
+++ b/third_party/libwebp/demux/demux.c
@@ -597,6 +597,25 @@ static int IsValidSimpleFormat(const WebPDemuxer* const dmux) {
   return 1;
 }
 
+// If 'exact' is true, check that the image resolution matches the canvas.
+// If 'exact' is false, check that the x/y offsets do not exceed the canvas.
+static int CheckFrameBounds(const Frame* const frame, int exact,
+                            int canvas_width, int canvas_height) {
+  if (exact) {
+    if (frame->x_offset_ != 0 || frame->y_offset_ != 0) {
+      return 0;
+    }
+    if (frame->width_ != canvas_width || frame->height_ != canvas_height) {
+      return 0;
+    }
+  } else {
+    if (frame->x_offset_ < 0 || frame->y_offset_ < 0) return 0;
+    if (frame->width_ + frame->x_offset_ > canvas_width) return 0;
+    if (frame->height_ + frame->y_offset_ > canvas_height) return 0;
+  }
+  return 1;
+}
+
 static int IsValidExtendedFormat(const WebPDemuxer* const dmux) {
   const int has_fragments = !!(dmux->feature_flags_ & FRAGMENTS_FLAG);
   const int has_frames = !!(dmux->feature_flags_ & ANIMATION_FLAG);
@@ -620,7 +639,6 @@ static int IsValidExtendedFormat(const WebPDemuxer* const dmux) {
 
       if (!has_fragments && f->is_fragment_) return 0;
       if (!has_frames && f->frame_num_ > 1) return 0;
-      if (f->x_offset_ < 0 || f->y_offset_ < 0) return 0;
       if (f->complete_) {
         if (alpha->size_ == 0 && image->size_ == 0) return 0;
         // Ensure alpha precedes image bitstream.
@@ -642,6 +660,12 @@ static int IsValidExtendedFormat(const WebPDemuxer* const dmux) {
         if (f->next_ != NULL) return 0;
       }
 
+      if (f->width_ > 0 && f->height_ > 0 &&
+          !CheckFrameBounds(f, !(has_frames || has_fragments),
+                            dmux->canvas_width_, dmux->canvas_height_)) {
+        return 0;
+      }
+
       fragment_count += f->is_fragment_;
       ++frame_count;
     }