Fix invalid image parsing for kNormalizeChannels
Change-Id: I0667eb494f689b6f0258fea5c7341294bb0f6787
Reviewed-on: https://chromium-review.googlesource.com/c/codecs/libwebp2/+/6258314
Reviewed-by: Maryla Ustarroz-Calonge <maryla@google.com>
Tested-by: WebM Builds <builds@webmproject.org>
diff --git a/src/dec/lossless/losslessi_dec.cc b/src/dec/lossless/losslessi_dec.cc
index de414c5..ae41c1b 100644
--- a/src/dec/lossless/losslessi_dec.cc
+++ b/src/dec/lossless/losslessi_dec.cc
@@ -276,15 +276,29 @@
// Inverse transforms.
for (int ind = num_transforms - 1; ind >= 0; --ind) {
const Transform& transform = transforms_[ind];
+ // Check that all color map indices are valid here rather than in dsp.
+ // The size(s) of the palette(s) could be deduced from the previous
+ // transforms. Except values could still be negative which seems hard to
+ // impose as a constraint.
+ // The following needs to be checked in case of invalid images.
if (transform.header_.type == TransformType::kColorIndexing) {
- // Check that all color map indices are valid here rather than in dsp.
- // TODO(yguyon): Remove pessimization.
const int16_t color_map_size = (int16_t)transform.data_.size() / 4;
const int16_t* const r_end = rows + 4 * num_rows * transform.width_pic_;
for (const int16_t* r = rows; r < r_end; r += 4) {
WP2_CHECK_OK(r[2] >= 0 && r[2] < color_map_size,
WP2_STATUS_BITSTREAM_ERROR);
}
+ } else if (transform.header_.type == TransformType::kNormalizeChannels) {
+ const int16_t* const r_end = rows + 4 * num_rows * transform.width_pic_;
+ for (const int16_t* r = rows; r < r_end; r += 4) {
+ for (uint32_t c = gparams_->has_alpha_ ? 0 : 1; c < 4; ++c) {
+ WP2_CHECK_OK(
+ r[c] >= 0 &&
+ r[c] <= static_cast<int16_t>(
+ transform.header_.normalize_channels_max[c]),
+ WP2_STATUS_BITSTREAM_ERROR);
+ }
+ }
}
std::array<int32_t, 4> minima_range, maxima_range;
if (transform.header_.type == TransformType::kPredictor ||
