)]}' { "log": [ { "commit": "1844042d1ca751e62e61df7617dba19c98588339", "tree": "fd137ab9d3c76298737fab9f1c994d3b260b00bc", "parents": [ "7790cde178c1c33d83f1d7474d41d3b44bf9b315" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Mon Oct 19 09:21:27 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Mon Oct 19 09:34:01 2026" }, "message": "Fix invalid bitstream handling when start[0]\u003d\u003d255\n\nBUG: 574243267, 575096093\n\nChange-Id: Id91a5118e0ee6a6f1556b1004a41558b05872ceb\n" }, { "commit": "7790cde178c1c33d83f1d7474d41d3b44bf9b315", "tree": "8a5aad35bd04a1f23ad17770d58c81c7b115c57a", "parents": [ "0464ce36981fc8169f69923eb6957dd46848967a", "e08dd0407846ae90890ecac8371c02f2be23dc61" ], "author": { "name": "James Zern", "email": "jzern@google.com", "time": "Sun Oct 18 23:28:49 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Sun Oct 18 23:28:49 2026" }, "message": "Merge \"cwebp: point to -exact in the -lossless help\" into main" }, { "commit": "0464ce36981fc8169f69923eb6957dd46848967a", "tree": "4aac1358f3cbe41f89eb09645d81761489dac215", "parents": [ "4f1384dff81fb9a4764d6194d59a16ca5c830020" ], "author": { "name": "clang-format", "email": "noreply@google.com", "time": "Sun Oct 04 00:42:08 2026" }, "committer": { "name": "James Zern", "email": "jzern@google.com", "time": "Fri Oct 16 20:12:20 2026" }, "message": "apply clang-format-21\n\n(Debian clang-format version 21.1.8 (3))\n\nNo options in .clang-format needed to be updated.\n\nBug: 569277013\nChange-Id: I3cfb11afe9df3a830f1cad93445356dccea31c2e\n" }, { "commit": "4f1384dff81fb9a4764d6194d59a16ca5c830020", "tree": "7217e64ba74c6c8b4629c214b96460be25353a7b", "parents": [ "a34daf6782578ad7c0da52911791bac587e56ca2" ], "author": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Fri Oct 16 13:47:53 2026" }, "committer": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Fri Oct 16 13:47:53 2026" }, "message": "Call incremental getters in advanced_api_fuzzer\n\nExercise WebPIDecodedArea, WebPIDecGetRGB, and WebPIDecGetYUVA after\nincremental decoding in AdvancedApiTest (advanced_api_fuzzer.cc).\n\nChange-Id: I58860c79e5511b7b0f2d94fce7e831373e329de8\n" }, { "commit": "a34daf6782578ad7c0da52911791bac587e56ca2", "tree": "451d8b36c0ed3ca6d022d29edd692bc57865df85", "parents": [ "e77d4e75649459ee4c212a1540ab6ea58c9a7707" ], "author": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Thu Oct 15 12:38:00 2026" }, "committer": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Thu Oct 15 12:38:00 2026" }, "message": "Reset dst cursor in VP8LBitWriterClone\n\nIn VP8LBitWriterClone (bit_writer_utils.c), reset dst-\u003ecur \u003d dst-\u003ebuf\nbefore VP8LBitWriterResize(dst, current_size) so cloning into a reused\nVP8LBitWriter does not over-allocate or copy stale bytes.\n\nChange-Id: I5bed40a762e974c03bd09b525aaf9444c2344023\n" }, { "commit": "e77d4e75649459ee4c212a1540ab6ea58c9a7707", "tree": "6f0ee9cbd7870e02428624e58dda914435e4bc0f", "parents": [ "479a2f086ace05582fd0ea1263ae5ff887d48f14" ], "author": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Thu Oct 15 11:49:29 2026" }, "committer": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Thu Oct 15 11:49:29 2026" }, "message": "Fix MSA upsampling right shifts and temp buffers\n\nAdd SRLI_B logical byte right-shift macro in msa_macro.h and use it\ninstead of arithmetic SRAI_B in UPSAMPLE_RGB565 and UPSAMPLE_RGBA4444\n(upsampling_msa.c) to avoid sign-extension bit corruption when channel\nvalues have MSB set.\n\nAlso zero-initialize temp_u and temp_v in UPSAMPLE_FUNC.\n\nChange-Id: I9a5a61b354096515688d83a4cc9ca83163c811a7\n" }, { "commit": "479a2f086ace05582fd0ea1263ae5ff887d48f14", "tree": "7a6844a52ede960b3fcb7a2245e7da0ba66b3776", "parents": [ "bbdd41116478efb2ac0c423947642ce122d075ba", "6e7e9a1655a15508ea8d3a07a3e874cb233fd381" ], "author": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Thu Oct 15 11:48:16 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Thu Oct 15 11:48:16 2026" }, "message": "Merge \"Clean up dead encoder symbols and redundant swap\" into main" }, { "commit": "6e7e9a1655a15508ea8d3a07a3e874cb233fd381", "tree": "a781dce3eb31f3c1996f018a46dd285a0e2635e6", "parents": [ "4b9e293a86d3ab96eb8ad2798514eddd10af27f2" ], "author": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Thu Oct 15 11:07:29 2026" }, "committer": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Thu Oct 15 11:07:29 2026" }, "message": "Clean up dead encoder symbols and redundant swap\n\nIn VP8LGetBackwardReferences (backward_references_enc.c), pass\n\u0026refs[0] directly to GetBackwardReferencesLowEffort and remove\nthe redundant BackwardRefsSwap(refs_best, \u0026refs[0]) self-swap.\n\nRemove unused kNone from enum Mode (backward_references_enc.h)\nand unused lambda_trellis from VP8SegmentInfo (vp8i_enc.h).\n\nChange-Id: I7ecabe01821a42a00b61e358e91cb813b9c759ec\n" }, { "commit": "bbdd41116478efb2ac0c423947642ce122d075ba", "tree": "9a64ccc849e463677ec389bbc954ec2f4b3c915b", "parents": [ "4b9e293a86d3ab96eb8ad2798514eddd10af27f2" ], "author": { "name": "Alejandro Pacheco", "email": "alepacheco99@gmail.com", "time": "Wed Oct 14 16:11:12 2026" }, "committer": { "name": "Alejandro Pacheco", "email": "alepacheco99@gmail.com", "time": "Thu Oct 15 08:36:38 2026" }, "message": "anim_encode: reject WebPAnimEncoderAdd() after assembling\n\nWebPAnimEncoderAssemble() flushes every cached frame to the mux, which\nleaves enc-\u003ecount at 0 while enc-\u003eis_first_frame is already 0. A later\nWebPAnimEncoderAdd() (with a frame or with NULL) then takes the\n\"not first frame\" path and calls GetFrame(enc, enc-\u003ecount - 1), which\nindexes before enc-\u003eencoded_frames; IncreasePreviousDuration() writes\nthe new duration there (AddressSanitizer: heap-buffer-overflow, WRITE\nof size 4 in IncreasePreviousDuration). The assert in GetFrame() only\ncatches this in debug builds.\n\nThe previous frame is already in the mux, so its duration can no\nlonger be extended: return an error instead, with\nVP8_ENC_ERROR_INVALID_CONFIGURATION in frame-\u003eerror_code. Assembling\nagain still returns the same animation.\n\nTested: new AnimIndexEncoder.AddAfterAssemble test crashes under ASan\nbefore and passes after; the other animencoder_fuzzer tests pass.\n\nChange-Id: I10ff6509d10ccfa782f2eae6fd7035c9f432567c\n" }, { "commit": "4b9e293a86d3ab96eb8ad2798514eddd10af27f2", "tree": "cad6b791d9a31c09f5ddca13da3df3aa0ddbff6c", "parents": [ "e01f99e6a080ebd3e2fba2d8b1619ef7dca95ca3", "a722298321b4cd8135899dbda284d53286ce13f6" ], "author": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Wed Oct 14 14:32:07 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Wed Oct 14 14:32:07 2026" }, "message": "Merge \"Fix single-frame anim offset check in muxedit\" into main" }, { "commit": "e01f99e6a080ebd3e2fba2d8b1619ef7dca95ca3", "tree": "398f756245537235a4a0174dae0407bc80e7d518", "parents": [ "4774a1da518bbba335edefc27694ccafa4ea5c7e", "8cf5ac754266b472dd302a59338a4495f0dc3199" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Oct 14 12:57:53 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Wed Oct 14 12:57:53 2026" }, "message": "Merge \"Compare incremental and one-shot decoding fuzzer\" into main" }, { "commit": "a722298321b4cd8135899dbda284d53286ce13f6", "tree": "5c017a74fd5e85d93c34416c1a0f50b4e7bfd16a", "parents": [ "4774a1da518bbba335edefc27694ccafa4ea5c7e" ], "author": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Wed Oct 14 12:31:39 2026" }, "committer": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Wed Oct 14 12:31:39 2026" }, "message": "Fix single-frame anim offset check in muxedit\n\nIn `GetAdjustedCanvasSize` (`muxedit.c`), only check `wpi-\u003eheader`\nfor ANMF offsets when `wpi-\u003eheader !\u003d NULL`. When assembling a\nsingle-frame animation with non-zero offsets, `MuxImageCompress`\nconverts the single frame to a regular WebP image without an ANMF\nheader, which previously caused `WebPMuxAssemble` to fail with\n`WEBP_MUX_INVALID_ARGUMENT`.\n\nChange-Id: I3ec799e5aac6025c403489d0b07705b0ca299ca2\n" }, { "commit": "4774a1da518bbba335edefc27694ccafa4ea5c7e", "tree": "84e0437a6fc03309c5340a1f798a735ed9fbf846", "parents": [ "93a88d64a4154e4b62b774b48b68bbdb68a792ba", "304721e4a2e55a52d533a1b23c21f0a8da3a2b21" ], "author": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Wed Oct 14 12:30:41 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Wed Oct 14 12:30:41 2026" }, "message": "Merge \"Fix level count and size checks in quant_levels\" into main" }, { "commit": "8cf5ac754266b472dd302a59338a4495f0dc3199", "tree": "a4f852171c90e5338f8a102f372973b9e0341094", "parents": [ "93a88d64a4154e4b62b774b48b68bbdb68a792ba" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Oct 14 11:05:57 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Oct 14 12:00:32 2026" }, "message": "Compare incremental and one-shot decoding fuzzer\n\nAdds validation to check that incremental decoding produces the\nsame output as one-shot WebPDecode() when both operations succeed.\nAlso updates crop_left and crop_top calculations to use decoder\noptions for better fuzzer coverage.\n\nChange-Id: I3583b9b381cf06e0a2c3d434a38d397ac1d1802d\n" }, { "commit": "304721e4a2e55a52d533a1b23c21f0a8da3a2b21", "tree": "455ae6418eb8a595b2dd0d7302c1c575b324467f", "parents": [ "94fa631a4d3cd6ce12149f842641383913f15174" ], "author": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Wed Oct 14 09:55:27 2026" }, "committer": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Wed Oct 14 11:31:41 2026" }, "message": "Fix level count and size checks in quant_levels\n\nIn InitParams (quant_levels_dec_utils.c), return early when\nnum_levels \u003c\u003d 2 so binary images skip smooth-filter LUT setup.\n\nIn QuantizeLevels (quant_levels_utils.c), compute data_size as\n(size_t)height * width after validating dimensions.\n\nChange-Id: I07ec71508c7826df8c49da3afe1aa4f7f4ad6774\n" }, { "commit": "93a88d64a4154e4b62b774b48b68bbdb68a792ba", "tree": "1042a13c7aeae19310adae49dc656a0314ae9371", "parents": [ "94fa631a4d3cd6ce12149f842641383913f15174" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Oct 14 09:40:37 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Oct 14 09:40:37 2026" }, "message": "Remove redundant integer casts\n\nWebPValidatePicture gives some guarantees on width/height.\n\nChange-Id: Ibf33574f03f51b88d211830892e7a128b364f7d9\n" }, { "commit": "94fa631a4d3cd6ce12149f842641383913f15174", "tree": "7ff33a26f78b540a428506a34d3b93ad6532908e", "parents": [ "0c7ffd17e9b89eb6ec4219a976886867880b0f25", "541b9c461e2c37e33145a3bf08d43d4009491947" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Oct 14 08:24:10 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Wed Oct 14 08:24:10 2026" }, "message": "Merge \"idec: stop VP8 decoding at the crop window\u0027s last row\" into main" }, { "commit": "0c7ffd17e9b89eb6ec4219a976886867880b0f25", "tree": "47057c52ef5269911dc541ada192456d210d6595", "parents": [ "abd0127ea848432e2a199aefcdd244eb886631a7" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 13 15:29:56 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 13 20:52:37 2026" }, "message": "Fix state rollback, frame flushing, and bounds checks\n\nValidate inputs before modifying encoder state, restore state on\nframe addition errors, avoid aliasing prev_canvas for disposed\ncandidates, and fix frame flushing and rectangle clipping edge\ncases.\n\nSetFrame previously reused enc-\u003eprev_canvas as scratch space for\ncanvas_carryover_disposed, assuming enc-\u003eprev_canvas would always\nbe overwritten at the end of CacheFrame. However, if SetFrame fails\n(for example, when aborted by progress_hook), CacheFrame returns\nearly before enc-\u003eprev_canvas is updated, leaving it corrupted for\nsubsequent WebPAnimEncoderAdd calls. Allocating a separate\ncanvas_carryover_disposed buffer keeps enc-\u003eprev_canvas intact on\nerror.\n\nChange-Id: I0b89d9f7f9bbc5626b010bbfa601df4d59be3118\n" }, { "commit": "541b9c461e2c37e33145a3bf08d43d4009491947", "tree": "5af6a74fda72a809ed49c89a43b155f55c1387c1", "parents": [ "abd0127ea848432e2a199aefcdd244eb886631a7" ], "author": { "name": "Alejandro Pacheco", "email": "alepacheco99@gmail.com", "time": "Mon Oct 12 11:45:14 2026" }, "committer": { "name": "Alejandro Pacheco", "email": "alepacheco99@gmail.com", "time": "Tue Oct 13 15:49:39 2026" }, "message": "idec: stop VP8 decoding at the crop window\u0027s last row\n\nWith cropping, WebPDecode() parses macroblock rows only up to\ndec-\u003ebr_mb_y, but the incremental decoder looped up to dec-\u003emb_h and\nreconstructed every row below the crop window. Past br_mb_y - 1,\nFinishRow() handles each row as the last one and does not rotate the\nloop-filter context rows into the top of the cache, yet\nVP8ProcessRow() still filters row br_mb_y (mb_y \u003c\u003d br_mb_y). Its\nvertical filter then reads cache rows that were never written\n(MemorySanitizer: use-of-uninitialized-value in NeedsFilter2_C, origin\nAllocateMemory() in frame_dec.c). The emitted pixels are not affected.\n\nThe extra rows also made WebPIAppend()/WebPIUpdate() wait for, and\nfail on, data that WebPDecode() never reads: a stream with a valid crop\nwindow and a damaged bottom part decodes with WebPDecode() but returned\nVP8_STATUS_BITSTREAM_ERROR incrementally.\n\nStop at br_mb_y like ParseFrame(). Without cropping br_mb_y \u003d\u003d mb_h, so\nfull decodes are unchanged.\n\nTested: new AdvancedApi.IncrementalCropStopsAtCropBottom test fails\nbefore (the whole stream is consumed for an 8-row crop) and passes\nafter; MSan reproducers from a crop/incremental differential fuzzer are\nclean; dwebp output is byte-identical to the parent commit over the\nlibwebp-test-data files with 10 crop/incremental/-mt option sets.\n\nChange-Id: Ic8afb9c733d7d7eafb636d436ae5a3be1e937426\n" }, { "commit": "abd0127ea848432e2a199aefcdd244eb886631a7", "tree": "4e1e62470c9560046f1a95e46c439b3051434e8d", "parents": [ "3f9e7e039ef780bd599482fca83ae9a8d6eb3f8f" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 13 14:24:35 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 13 14:24:35 2026" }, "message": "Tighten and simplify WebPPicture validation and import errors\n\nSimplify CheckMemoryBounds and WebPValidatePicture, and use\nWebPValidateAllocatedPicture across picture helpers. Preserve or\nreset picture state on allocation and import errors.\n\nChange-Id: Ib22e0972a725b844664e0697c68f397a5f589a8a\n" }, { "commit": "3f9e7e039ef780bd599482fca83ae9a8d6eb3f8f", "tree": "36b12b8db4d27aae0421567ed565301b73381be6", "parents": [ "5c8c69ebd8a5836284b4ed4a01ce8b502db571f1" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 13 13:33:07 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 13 13:33:07 2026" }, "message": "Fix validation, state preservation, and edge cases\n\nValidate new image and chunk data before deleting existing entries,\ninitialize output structs in getters, and tighten chunk size,\ncanvas area, and single-image parsing checks.\n\nChange-Id: I1f29838034cb97f9cf7f572a713033ce02d600c4\n" }, { "commit": "5c8c69ebd8a5836284b4ed4a01ce8b502db571f1", "tree": "6dddc82bd3ecec21143d74be2b0b95941a54fa74", "parents": [ "729223a10cda45e24be1f5045ada0d5600f65b0c" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 13 12:43:37 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 13 12:43:37 2026" }, "message": "Fix error handling and bounds checks in decoder, utils, sharpyuv\n\nSet error state on incremental decoding failures, free rescaler\nmemory on setup failure, fix pointer and integer bounds in\nquant_levels and rescaler utils, and reject reserved transfer\nfunctions in sharpyuv.\n\nChange-Id: I923e13d81e576e8c4ea295f8e0c26b889cfc75a9\n" }, { "commit": "729223a10cda45e24be1f5045ada0d5600f65b0c", "tree": "25300f34870da0e604cdec3bfe988b3d544cac68", "parents": [ "c3259e0a10d2b78c586e10bbdf8445c4eb19a438" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 13 12:15:39 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 13 12:17:07 2026" }, "message": "Propagate encoder progress aborts and tighten config\n\nMark WebPReportProgress as WEBP_NODISCARD and propagate user aborts\nfrom ResetAllMBInfo and StoreStats. Set error code on alpha filter\ninit failure and reject negative image_hint in WebPValidateConfig.\n\nChange-Id: I713e6febf02ed0b2a39c4883e4680b7b6d94d2f6\n" }, { "commit": "c3259e0a10d2b78c586e10bbdf8445c4eb19a438", "tree": "05b517917fe1e7f62ce984b4d4661f291c4b58f3", "parents": [ "315e817b2e319bea59ecd6963ee0f5aa5db49a8f" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 13 08:40:11 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 13 08:40:11 2026" }, "message": "Fix error-path leaks and input validation in tools\n\nChange-Id: Ie07bebae4af85d6cd5ba94414e94c5156ab27d95\n" }, { "commit": "315e817b2e319bea59ecd6963ee0f5aa5db49a8f", "tree": "fb005622c242c86898d2c4dec896af6fa90600bd", "parents": [ "528e7a4f9399c006068557e0c82506a722cbadbc" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 13 08:38:15 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 13 08:39:51 2026" }, "message": "Fix CheckNonOpaque in VP8L decoder and avoid fuzzer timeouts.\n\nChange-Id: I7147f87a6d2bc1e4ead3997c4869dc9240534a97\n" }, { "commit": "528e7a4f9399c006068557e0c82506a722cbadbc", "tree": "2c35c7690a3b340eb02898b0f77f7757bab41754", "parents": [ "1c85c37f93315054e6138cc94d1f58b60749833d" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Mon Oct 12 12:17:42 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Mon Oct 12 13:08:39 2026" }, "message": "Validate unallocated WebPPicture planes and strides\n\n- Add internal WebPValidateAllocatedPicture to validate dimensions and\n ensure required plane buffers are allocated (argb if use_argb, or y/u/v\n and a if WEBP_CSP_ALPHA_BIT), and use it in WebPBlendAlpha,\n WebPPictureCopy, WebPPictureCrop, WebPPictureRescale, and WebPPictureView.\n- Check for NULL plane pointers in WebPReplaceTransparentPixels,\n WebPCleanupTransparentArea, and WebPPictureDistortion.\n- Avoid size_t multiplication overflow in WebPPlaneDistortion when\n checking src_stride / ref_stride against x_step * width.\n- Change ApplyPalette src_stride and dst_stride parameters in vp8l_enc.c\n from uint32_t to int so lossless palette encoding works with negative\n argb_stride.\n- Reset pic-\u003euse_argb \u003d 0 in WebPImportGray before allocating YUV planes.\n- Add independent unit tests in test_enc_api.cc and test_extras_api.cc.\n\nChange-Id: I24aca643b8c83f47d4ba8daef161ad11820325db\n" }, { "commit": "1c85c37f93315054e6138cc94d1f58b60749833d", "tree": "79960af96b7644db054abcee9aa4df872341c1da", "parents": [ "68dd1c3040d500f56fe7ffb754b1813fb64b5887" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Mon Oct 12 10:43:47 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Mon Oct 12 10:43:47 2026" }, "message": "Fix review comments\n\nChange-Id: I7530c599ceaa88493684be77887611211c8b3f53\n" }, { "commit": "68dd1c3040d500f56fe7ffb754b1813fb64b5887", "tree": "417b4b67236ffb1982ed36d229a5053be7492e10", "parents": [ "902630c4b95abad78b2fa96fd99d0e50b48d155d" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Fri Oct 09 13:07:48 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Fri Oct 09 13:07:48 2026" }, "message": "Account for rounding and carry-over in WebPRescalerNeeds64Bit.\n\nDuring horizontal downscaling (src_width \u003e\u003d dst_width),\nWebPRescalerImportRowShrink scales each input row using\nMULT_FIX(sum, x_scale), which adds ROUNDER before shifting and\ncan increase the row sum in frow by up to\ndst_width / 2 above 255 * src_width. Additionally, during vertical\ndownscaling (src_height \u003e\u003d dst_height), EXPORT_ROW_SHRINK\ninitializes irow with the fractional carry-over frac (\u003c frow) from\nthe previous export cycle, and WebPRescalerImport then adds up to\nceil(src_height / dst_height) full frow rows to irow before the\nnext export subtracts the new frac.\n\nInclude the dst_width / 2 horizontal rounding bound and the extra\ncarry-over row (+ 1) in WebPRescalerNeeds64Bit so 32-bit irow\naccumulator overflows are prevented.\n\nChange-Id: If1ec0f46d61b79a5e4ab98e5a48388667403cae0\n" }, { "commit": "902630c4b95abad78b2fa96fd99d0e50b48d155d", "tree": "64d64fe5ca8e568d0b15081d164e3a9f41478d5d", "parents": [ "ace1fa526b58657621686f41f9763509f8718baf" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Fri Oct 09 08:55:56 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Fri Oct 09 10:34:39 2026" }, "message": "Fix MIPS DSP filter prediction and MSA shift macros.\n\nIn DO_PREDICT_LINE (filters_mips_dsp_r2.c), when INVERSE is 0\n(forward filter prediction), the 1-byte remainder loop loaded\nsrc[-1] into temp1 and src[0] into temp2, but executed subu\ntemp3, temp1, temp2 (src[-1] - src[0]) instead of\nsrc[0] - src[-1] as performed by the 4-byte loop and\nC reference implementation. In msa_macro.h, SRLI_H expanded to a\nright-shift (__msa_srli_h) under CLANG_BUILD and\na left-shift (a \u003c\u003c b) under GCC, while its only caller in\nFTransform_MSA (enc_msa.c) requires a left-shift by 3 bits\n(SLLI_H). Additionally, SLLI_B cast its first argument to (v4i32)\ninstead of (v16i8).\n\nSwap the subu source operands in the 1-byte remainder loop of\nDO_PREDICT_LINE, replace SRLI_H with SLLI_H (__msa_slli_h) in\nmsa_macro.h and FTransform_MSA, and cast the input vector in\nSLLI_B to (v16i8).\n\nChange-Id: I6b133ba2b62022fe2657f4c637db564091441e2e\n" }, { "commit": "ace1fa526b58657621686f41f9763509f8718baf", "tree": "5e4381c546e047abf5a198282a58a2d491500e42", "parents": [ "ffda14079ddddea68163c941b05a74e4a7ba54c1" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Fri Oct 09 09:04:50 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Fri Oct 09 10:34:39 2026" }, "message": "Prevent 32-bit int overflows in row * stride pointer offsets.\n\n- Cast row indices and strides to ptrdiff_t or size_t before multiplying\n in sharpyuv.c, alpha_dec.c, io_dec.c, lossless_enc_sse2.c,\n lossless_enc_sse41.c, lossless_enc_avx2.c, yuv.c, alpha_enc.c,\n iterator_enc.c, near_lossless_enc.c, picture_csp_enc.c, and\n picture_tools_enc.c.\n- Change CheckNonOpaque y_step parameter to ptrdiff_t in\n picture_csp_enc.c.\n- Add regression test in test_decode_stride.cc.\n\nChange-Id: I8951f4d4d947a5174f88c46d5b306d7e45318f78\n" }, { "commit": "ffda14079ddddea68163c941b05a74e4a7ba54c1", "tree": "07025cef954a9f1f95dde97c83f23e26500da825", "parents": [ "5dd76fc11dc7e421b4c9e96300e895652d0f8bab" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Fri Oct 09 08:56:55 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Fri Oct 09 10:34:38 2026" }, "message": "Fix minor logic bugs.\n\nIn `WebPMuxGetAnimationParams`, `kChunks` was indexed using\n`WEBP_CHUNK_ANIM` (a `WebPChunkId` enum value of 2) instead of\n`IDX_ANIM` (a `CHUNK_INDEX` value of 1), reading the minimum\nchunk size from `kChunks[IDX_ANMF]` instead of `kChunks[IDX_ANIM]`.\n\nChange-Id: Ia9377704b5c07469e95b4fddcfb02103f523c1f6\n" }, { "commit": "5dd76fc11dc7e421b4c9e96300e895652d0f8bab", "tree": "d9508eff740b9c2ee285dd5599a81691049c18cc", "parents": [ "0976221aab2fc322b2e00c46917b28c064643217" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Fri Oct 09 08:55:42 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Fri Oct 09 08:55:42 2026" }, "message": "Fix lower-lane shift in PredictorAdd12_AVX2.\n\nChange-Id: I8640ae1a1897cf3d1de4dba0cafa478645bc1e03\n" }, { "commit": "0976221aab2fc322b2e00c46917b28c064643217", "tree": "60e4d961f7ad55edc82a3fd9a247587367e82561", "parents": [ "097153b2a4b33f5e4ffa9f4603f63902bbd79169" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Fri Oct 09 08:55:23 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Fri Oct 09 08:55:23 2026" }, "message": "Use subsampling_index when initializing best_histo\n\nChange-Id: I2cf630f337bf8d04a64bcf25480eda799132d285\n" }, { "commit": "097153b2a4b33f5e4ffa9f4603f63902bbd79169", "tree": "e38a447253068ba0c5552140cbc3f28eb4196cf1", "parents": [ "5f221932aba4d3b341d5ff5f2f3baa5b35b01501" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Oct 08 15:10:44 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Oct 08 15:10:44 2026" }, "message": "Fix bad comment\n\nChange-Id: If36027f7a3a1f1c12634538642470d5a4d7893bc\n" }, { "commit": "5f221932aba4d3b341d5ff5f2f3baa5b35b01501", "tree": "611bcc65ceceb8cab6e9de962f0727942fa6837b", "parents": [ "7073d86ced421fee654eeb84c5255ed88e1ebffa" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Oct 08 14:14:21 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Oct 08 14:14:21 2026" }, "message": "Improve stride handling and buffer validation\n\n- Use ptrdiff_t for pointer offset calculations during stride arithmetic\n to prevent signed integer overflow when offsetting buffer pointers\n (vp8l_dec.c, picture_rescale_enc.c, picture_csp_enc.c).\n- Update VP8SSIMGet and VP8SSIMGetClipped (and their DSP implementations\n in ssim.c, ssim_sse2.c, and dsp.h) and AccumulateFunc in picture_psnr_enc.c\n to take ptrdiff_t stride parameters, preserving negative stride support.\n- In WebPValidatePicture, validate buffer strides against picture\n dimensions, check that ARGB byte stride fits in int bounds, and check\n that planes fit in addressable memory without address space wrapping.\n- In CheckStride, prevent undefined behavior when negating negative strides\n (e.g., INT_MIN).\n- In Import, call WebPPictureFree before WebPValidatePicture to safely\n allow recycling WebPPicture instances with updated dimensions.\n- Add unit tests in test_enc_api.cc for picture recycling, validation, and\n memory bounds.\n\nChange-Id: Ie429f95aa1b7c69df841870f1eef9a8bb474a5b5\n" }, { "commit": "7073d86ced421fee654eeb84c5255ed88e1ebffa", "tree": "371e9d6087666587f9804c238bb58c1096968158", "parents": [ "c402056738928167667d098d94a5db8447665d4e" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Oct 08 11:18:00 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Oct 08 11:33:08 2026" }, "message": "Expand libwebp fuzzer coverage\n\n- fix bad argb buffer filling\n- add a tiled image generator (`CreateTiledWebPPicture`) in\n`fuzz_utils.h` with low per-tile channel entropy and relax the\nlossless `method` clamp in `Enc` so lossless encoding exercises\nfull, non-identity Huffman group mappings.\n- in `EncDecValidTest`, decode with `decoder_options` into a\nseparate `WebPDecoderConfig` and verify that unscaled, undithered\ncropped alpha matches the uncropped decode.\n- widen the `kmin` and `kmax` domains in `animencoder_fuzzer` to\nthe full `int` range and abort when `WebPAnimEncoderNew` fails\nunexpectedly\n- add `MuxEditApiTest` to `mux_demux_api_fuzzer` to fuzz\n`WebPMuxNew` and the mux editing and assembly APIs\n(`WebPMuxSetCanvasSize`, `WebPMuxSetAnimationParams`,\n`WebPMuxSetImage`, `WebPMuxPushFrame`, `WebPMuxSetChunk`,\n`WebPMuxDeleteChunk`, `WebPMuxDeleteFrame`, and `WebPMuxAssemble`).\n\nChange-Id: I3e547b5f3c41a605ceddea477535fdbc6d2d85fa\n" }, { "commit": "c402056738928167667d098d94a5db8447665d4e", "tree": "621d0e29dcf142db1fbef954cb371f0503ef64ec", "parents": [ "80115de6b6bcda89711cd232e26526a3010dad9e" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Oct 08 09:48:42 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Oct 08 09:48:42 2026" }, "message": "Bump fuzztest to the latest tag\n\nChange-Id: I876b12eba1324388f48fdc836048c5ead71949b9\n" }, { "commit": "80115de6b6bcda89711cd232e26526a3010dad9e", "tree": "1956371e10055c0e50fc32a53e64f0c84ac859c6", "parents": [ "a53957a41ef2c01cc8b63f629c5712ccd303890c" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Oct 08 08:07:23 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Oct 08 08:53:11 2026" }, "message": "Add WEBP_IS_ALIGNED macro and clean up alignments\n\nIntroduce WEBP_IS_ALIGNED.\n\nSimplify SIMD functions by removing intermediate vector pointer\ncasts.\n\nChange-Id: I970a5436b33dc2c615c83c9ac065c4cd0e40bf29\n" }, { "commit": "a53957a41ef2c01cc8b63f629c5712ccd303890c", "tree": "15a5100d8b039cf7b502f229ee692e121771ef35", "parents": [ "a2727c6afe4d7bb7ada23b12defa890e54cb6d2a" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Oct 07 18:07:37 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Oct 07 18:07:37 2026" }, "message": "Fix paletted alpha unfiltering and window shift with crop_top\n\nIn ExtractPalettedAlphaRows(), WEBP_FILTER_HORIZONTAL predicts the first\npixel of each row from prev_line[0] (the leftmost pixel of the preceding\nrow). Skipping rows above crop_top caused prev_line to be NULL at\ncrop_top, shifting all decoded alpha values in the cropped region. Only\nskip rows above crop_top for WEBP_FILTER_NONE, and always call\nWebPShiftAlphaWindow() so output_start_row tracks the sliding window\neven above crop_top. Also avoid advancing io plane pointers past cache\nand alpha window bounds in FinishRow() when y_end \u003c\u003d io-\u003ecrop_top.\n\nChange-Id: I9bed8d06ca4c5e00d0fd128ebddf21ec1090a8b1\n" }, { "commit": "a2727c6afe4d7bb7ada23b12defa890e54cb6d2a", "tree": "0af16da5fcdb35ce9e1b84374a979c2b9d67f727", "parents": [ "59070caecf2ca9d646e8442e2ccf83c932e72d1a" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Oct 07 15:24:01 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Oct 07 18:07:25 2026" }, "message": "Optimize GetEntropyUnrefinedHelper\n\nPass `val_prev` and `i_prev` by value in `GetEntropyUnrefinedHelper`\nand move the `stats-\u003ecounts` and `stats-\u003estreaks` updates inside the\n`val_prev !\u003d 0` branch so they use constant array indices (`[1]` vs\n`[0]`) and keep loop state in registers in `GetEntropyUnrefined_C`\nand `GetCombinedEntropyUnrefined_C`.\n\nChange-Id: Ia39487b916cfc84588cba9c16013de063414abd8\n" }, { "commit": "59070caecf2ca9d646e8442e2ccf83c932e72d1a", "tree": "fd409dc7b8352d2c1214b900f2b08b9e1c8b05af", "parents": [ "7a149e33c7e95d9321a9fd5b76b70e991e895dc6" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Oct 07 13:39:03 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Oct 07 18:07:25 2026" }, "message": "Avoid redundant PaletteSort work and duplicate palette configs\n\n- In `CoOccurrenceBuild`, `palette_sorted` is already sorted in\n lexicographical order, so remove the redundant `PrepareMapToPalette`\n call and `idx_map` indirection.\n- In `PaletteSortModifiedZeng`, optionally run `PaletteMinLARefine`\n directly on the existing `cooccurrence` matrix and `remapping` array\n for `kMinLAFromZeng` instead of rebuilding the co-occurrence matrix\n from the image a second time in `PaletteMinLARefineColors`.\n- In `EncodeStreamHook`, skip re-encoding a palette crunch config when\n `PaletteSort` produces a palette identical to one already evaluated\n for the same `entropy_idx`.\n\nChange-Id: I58a1e17aa357a28197a0058b222de94694a9f706\n" }, { "commit": "7a149e33c7e95d9321a9fd5b76b70e991e895dc6", "tree": "1173f387056f4c614dfb63c61d6c6cdaed7f1b5e", "parents": [ "8d6440102e9431ca9c60ad7976c03a763363a904", "6b1fa207c3762a93a3a9171a3e4e544027aa3987" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Oct 07 15:16:52 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Wed Oct 07 15:16:52 2026" }, "message": "Merge \"WebPValidateConfig: reject NaN quality and target_PSNR\" into main" }, { "commit": "8d6440102e9431ca9c60ad7976c03a763363a904", "tree": "392de8700b432c7b8189b26e77b7c4ad2ff9cd3b", "parents": [ "718a3d08a7c0925afb1dc78817fb8a092ed21663", "b31469df4838ad8be602a419d549ab93bff2f432" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Oct 07 15:16:47 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Wed Oct 07 15:16:47 2026" }, "message": "Merge \"Import: don\u0027t read unaligned RGBA input through uint32_t*\" into main" }, { "commit": "6b1fa207c3762a93a3a9171a3e4e544027aa3987", "tree": "83b8b73b79367bfc87030c3fc3f6da297b836c24", "parents": [ "6c8f8c5f477450ce14aa1209a5b910edcfac085e" ], "author": { "name": "Filippo Tedeschi", "email": "filippotedeschi98@gmail.com", "time": "Tue Oct 06 16:21:07 2026" }, "committer": { "name": "Filippo Tedeschi", "email": "filippotedeschi98@gmail.com", "time": "Wed Oct 07 13:15:39 2026" }, "message": "WebPValidateConfig: reject NaN quality and target_PSNR\n\nWebPValidateConfig() checks \u0027quality \u003c 0 || quality \u003e 100\u0027 and\n\u0027target_PSNR \u003c 0\u0027. Every comparison with NaN is false, so a NaN in\neither field passes validation and then reaches float to int\nconversions that are undefined for NaN, e.g. \u0027(int)config-\u003equality\u0027 in\nvp8l_enc.c, \u0027(int)(mb_w * mb_h * 4 * scale)\u0027 in webp_enc.c and\n\u0027(int)(127. * (1. - c))\u0027 in quant_enc.c\n(-fsanitize\u003dfloat-cast-overflow). The result of such a conversion is\nplatform dependent (INT_MIN on x86, 0 on arm64).\n\nWrite the checks as negated range tests so NaN is rejected and\nWebPEncode() fails with VP8_ENC_ERROR_INVALID_CONFIGURATION.\n\nAdd a regression test to tests/fuzzer/enc_fuzzer.cc.\n\nChange-Id: I27b8fde94f6517d44fb6985b2117a4d46e056b19\n" }, { "commit": "b31469df4838ad8be602a419d549ab93bff2f432", "tree": "94941327fdf96728ce840fc6a64602ae9b20e369", "parents": [ "6c8f8c5f477450ce14aa1209a5b910edcfac085e" ], "author": { "name": "Filippo Tedeschi", "email": "filippotedeschi98@gmail.com", "time": "Tue Oct 06 16:21:23 2026" }, "committer": { "name": "Filippo Tedeschi", "email": "filippotedeschi98@gmail.com", "time": "Wed Oct 07 13:15:39 2026" }, "message": "Import: don\u0027t read unaligned RGBA input through uint32_t*\n\nFor little-endian targets, Import() converts RGBA input to ARGB with\nVP8LConvertBGRAToRGBA((const uint32_t*)rgb, ...). \u0027rgb\u0027 comes from the\ncaller of WebPPictureImportRGBA() / WebPEncodeLosslessRGBA(), whose\ndocumentation does not require any alignment, and \u0027rgb_stride\u0027 is an\narbitrary byte count. The cast and the uint32_t loads done by the\nscalar converter (also used for the tail of the NEON and SSE2 ones) are\nundefined for such pointers (-fsanitize\u003dalignment) and can fault on\ntargets without unaligned loads.\n\nKeep the dispatched converter when the row is 4-byte aligned and\nassemble the ARGB words from bytes otherwise.\n\nAdd a regression test to tests/fuzzer/enc_dec_fuzzer.cc.\n\nChange-Id: Ieae6f42fed194bf897c8a0bbf68dd8fdee51007e\n" }, { "commit": "718a3d08a7c0925afb1dc78817fb8a092ed21663", "tree": "dc8087fb186cf23654debf33a7e8114cafd3ffcd", "parents": [ "6c8f8c5f477450ce14aa1209a5b910edcfac085e" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Oct 07 13:12:59 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Oct 07 13:12:59 2026" }, "message": "Validate cropped scaling dimensions in WebPValidateDecoderConfig\n\nIn WebPValidateDecoderConfig(), pass the cropped dimensions\n(crop_width, crop_height) to WebPRescalerGetScaledDimensions()\nwhen both cropping and scaling are enabled, matching\nWebPAllocateDecBuffer() and WebPIoInitFromOptions().\n\nChange-Id: I39699d1c02a5a6b1facb9ba2e62c513e8b1fadb2\n" }, { "commit": "6c8f8c5f477450ce14aa1209a5b910edcfac085e", "tree": "87d2705276a8a545aed8e27355289defa6e00b5b", "parents": [ "67b51fabf255d13358a91cef594e077d28d617c5", "21c53c132e587d9d3f04e733ed3662513e5fa741" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Oct 07 13:11:03 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Wed Oct 07 13:11:03 2026" }, "message": "Merge \"vp8l_dec: keep the Huffman group mapping when all groups are used\" into main" }, { "commit": "67b51fabf255d13358a91cef594e077d28d617c5", "tree": "d5c618f418d7d79751ea66472f4974db4202e39d", "parents": [ "ed4daf51fd94bf2d7ca874a9614364dcf7e77309", "6391cf3f2386f214d611864da952be94ce60d040" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Oct 07 13:10:55 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Wed Oct 07 13:10:55 2026" }, "message": "Merge \"WebPMuxSetCanvasSize: avoid signed overflow in area check\" into main" }, { "commit": "ed4daf51fd94bf2d7ca874a9614364dcf7e77309", "tree": "31996d5b9fef1e9513138affbdf14b1a6070bb4e", "parents": [ "1bdc76385531e2520991f3bcc09722ea7178a875" ], "author": { "name": "Filippo Tedeschi", "email": "filippotedeschi98@gmail.com", "time": "Tue Oct 06 16:20:30 2026" }, "committer": { "name": "Filippo Tedeschi", "email": "filippotedeschi98@gmail.com", "time": "Wed Oct 07 10:01:42 2026" }, "message": "anim_encode: avoid signed overflow when clamping kmin\n\nSanitizeEncoderOptions() limits the number of cached frames with\n\u0027kmax - kmin \u003e MAX_CACHED_FRAMES\u0027. For kmax \u003d\u003d 2 the previous kmin\nadjustments are skipped (kmin_limit \u003d\u003d kmax), so a user-provided kmin\nclose to INT_MIN reaches this subtraction unchanged and overflows\n\u0027int\u0027. The wrapped result is negative, so the clamp is skipped and\nWebPAnimEncoderNewInternal() overflows again in\n\u0027enc-\u003esize \u003d kmax - kmin + 1\u0027. With gcc -O1 (asserts enabled) enc-\u003esize\nthen stays negative, the frame allocation fails and\nWebPAnimEncoderNew() returns NULL instead of clamping kmin.\n\nkmax is at least 2 at that point, so \u0027kmax - MAX_CACHED_FRAMES\u0027 cannot\noverflow. Compare kmin against it instead, which is equivalent for\nall inputs that did not overflow. After clamping, kmax - kmin is\nbounded by MAX_CACHED_FRAMES and the later computation is safe.\n\nAdd a regression test to tests/fuzzer/animencoder_fuzzer.cc.\n\nChange-Id: I944f0a3fff333226141042291dedfccf892d3bda\n" }, { "commit": "21c53c132e587d9d3f04e733ed3662513e5fa741", "tree": "48d00e4615481a1fb438fc3d332edabaad45235f", "parents": [ "db992a0ca00572ce30fcda75f5d45e79b37a1a83" ], "author": { "name": "Filippo Tedeschi", "email": "filippotedeschi98@gmail.com", "time": "Tue Oct 06 16:32:47 2026" }, "committer": { "name": "Filippo Tedeschi", "email": "filippotedeschi98@gmail.com", "time": "Wed Oct 07 10:00:14 2026" }, "message": "vp8l_dec: keep the Huffman group mapping when all groups are used\n\n\u0027Tighter Huffman mapping trigger\u0027 made ReadHuffmanCodes() drop \u0027mapping\u0027\nwhen the remapping ends up with as many groups as num_htree_groups_max,\non the assumption that the mapping is then the identity. It is only a\npermutation: groups are renumbered in order of first use in the Huffman\nimage, and nothing forces that order to follow the numeric group ids.\n\nhuffman_image has already been rewritten with the new numbers, but\nReadHuffmanCodesHelper() then stores the i-th group read from the\nbitstream in htree_groups[i] instead of htree_groups[mapping[i]]. Pixels\nare decoded with the codes of another group: valid images with more\nthan 200 groups either decode to wrong pixels or fail with\nVP8_STATUS_BITSTREAM_ERROR. For example, an 11158x2156 image written by\n\u0027cwebp -lossless -z 6\u0027 from libwebp-test-data/bryce.webp decoded fine\nbefore that change and now fails.\n\nKeep the mapping whenever it was created. It is released on exit anyway.\n\nAdd a regression test to tests/fuzzer/simple_api_fuzzer.cc.\n\nChange-Id: Ia09cf6a13e693500d4ca841cdfaa683fa9ed0614\n" }, { "commit": "6391cf3f2386f214d611864da952be94ce60d040", "tree": "73ff7cec44920c7b30615f6d2e1398c6108e0387", "parents": [ "1bdc76385531e2520991f3bcc09722ea7178a875" ], "author": { "name": "Filippo Tedeschi", "email": "filippotedeschi98@gmail.com", "time": "Tue Oct 06 16:20:13 2026" }, "committer": { "name": "Filippo Tedeschi", "email": "filippotedeschi98@gmail.com", "time": "Tue Oct 06 21:13:27 2026" }, "message": "WebPMuxSetCanvasSize: avoid signed overflow in area check\n\nThe check rejecting a canvas with exactly one zero dimension computed\n\u0027width * height\u0027 in \u0027int\u0027. The area check just above only guarantees\nthat the product is below 2^32, so for valid canvases such as\n50000x50000 the multiplication exceeds INT_MAX, which is undefined\nbehavior (flagged by -fsanitize\u003dsigned-integer-overflow). The result\nwas only compared against zero and a non-zero product below 2^32 can\nnever wrap to zero, so valid sizes were not misclassified, but the UB\nis reachable from the public API.\n\nCompute the product in uint64_t, like the area check above it.\n\nAdd a regression test to tests/fuzzer/mux_demux_api_fuzzer.cc.\n\nChange-Id: I25f81dc30ce4e94ac807cdb50f3651bbe07fa709\n" }, { "commit": "1bdc76385531e2520991f3bcc09722ea7178a875", "tree": "69b533c137c91f8135013a753130678bfefe4979", "parents": [ "41fd85a72e072d4d14b0a59e20c3db303da8d7a5", "b4d85eea95fcd080d5669aed26cfebfb9c086d03" ], "author": { "name": "James Zern", "email": "jzern@google.com", "time": "Tue Oct 06 17:40:07 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Tue Oct 06 17:40:07 2026" }, "message": "Merge \"rescaler: fix unsigned overflow w/extreme scaling dimensions\" into main" }, { "commit": "41fd85a72e072d4d14b0a59e20c3db303da8d7a5", "tree": "dbd31d1af0eecef6e96ee96ea8bc99f666481726", "parents": [ "db992a0ca00572ce30fcda75f5d45e79b37a1a83" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 06 14:35:31 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 06 14:35:31 2026" }, "message": "Fix bot_y NULL check in upsamplers and MSA DSP loop increments\n\nIn DUAL_SAMPLE_FUNC (upsampling.c) and UPSAMPLE_FUNC\n(upsampling_msa.c), check bot_y !\u003d NULL instead of bot_dst !\u003d NULL\nor pbot_y !\u003d NULL so a NULL bottom row is never dereferenced even\nwhen bot_dst is non-NULL, and copy only (size + 1) UV bytes in\nupsampling_msa.c.\n\nAlso fix ExportRowShrink_0 in rescaler_msa.c to advance pointers\nby 8 when length \u003e\u003d 8, and fix AddGreenToBlueAndRed_MSA in\nlossless_msa.c to copy out[3] \u003d in[3] and advance in +\u003d 4 in the\ntail loop.\n\nChange-Id: I1d361d5eb47b090bf7244376a3c620f15f2e89c3\n" }, { "commit": "db992a0ca00572ce30fcda75f5d45e79b37a1a83", "tree": "c5bf39c33dcdef91a9ebcb7ad959c3e0ce90f32a", "parents": [ "b5a422670317f20e06a155b634cdfc7fd98da7c9", "652631be0333123a69dab036f5586894fc743ea6" ], "author": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Tue Oct 06 14:27:23 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Tue Oct 06 14:27:23 2026" }, "message": "Merge \"Fix double-free in FrameToFullCanvas() error path\" into main" }, { "commit": "b5a422670317f20e06a155b634cdfc7fd98da7c9", "tree": "894191a0768d2a109f708ff51385ddf879771119", "parents": [ "cf7e0cf79450d561caf7d2a56c566701f3abafea" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 06 09:54:40 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 06 12:45:54 2026" }, "message": "Skip SubtractGreen transforms when red and blue channels are zero\n\nWhen encoding an image whose red and blue channels are identically\nzero (such as alpha planes dispatched to the green channel in\nEncodeLossless), applying SubtractGreen copies -G into red and\nblue. This turns a single-channel image into a three-channel\nimage, tripling active channel processing in spatial prediction\nand histogram clustering while never improving compression over\nkDirect or kSpatial.\n\nSkip kSubGreen and kSpatialSubGreen in EncoderAnalyze brute-force\ncrunch mode when red and blue are always zero in the input image.\n\nChange-Id: Icb73e6072b6c5612a507e78c02004644dd5c2e3c\n" }, { "commit": "cf7e0cf79450d561caf7d2a56c566701f3abafea", "tree": "7c74a7e749e206431384b97e2d2c58442e80cdf9", "parents": [ "513790a57df389ea4e7b9bdf468630bba4181811", "6eed8ee01e2ef7187eff68695e47b48b9cd8c685" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 06 12:22:38 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Tue Oct 06 12:22:38 2026" }, "message": "Merge \"Use signed ptrdiff_t for potentially negative strides\" into main" }, { "commit": "6eed8ee01e2ef7187eff68695e47b48b9cd8c685", "tree": "321f40a4c9bb9436dca6385c0829f6a785c8d5e6", "parents": [ "7ff4af3c6bf1101e2d3d88f7e68f9d1cad2ef7e7" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 06 11:43:14 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 06 11:43:47 2026" }, "message": "Use signed ptrdiff_t for potentially negative strides\n\nCasting the row index to uint64_t in WebPWriteBMP and size_t in\nDoEstimateRisk promoted negative strides (such as when\noptions-\u003eflip is enabled) to unsigned integers, causing pointer\noverflow and out-of-bounds memory access.\n\nCast the row index to ptrdiff_t before multiplying by stride.\n\nChange-Id: Ia2c1a8842b3f1e889b99c4383ad1342205349346\n" }, { "commit": "513790a57df389ea4e7b9bdf468630bba4181811", "tree": "986c2304df37378e4ea6ce0a1c73c910a2b9313a", "parents": [ "7ff4af3c6bf1101e2d3d88f7e68f9d1cad2ef7e7" ], "author": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Tue Oct 06 11:30:40 2026" }, "committer": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Tue Oct 06 11:30:40 2026" }, "message": "Add WEBP_NODISCARD to MetadataCopy()\n\nChange-Id: Iee7272c6f7d92769982e09110856e61a9442ed52\n" }, { "commit": "7ff4af3c6bf1101e2d3d88f7e68f9d1cad2ef7e7", "tree": "aafb2f776e11838bbcc831c8f70c67e27af7077c", "parents": [ "164c8e9d88cbb26a42a18b3ded155e680e07e241", "56804941c987207096df7c78828414f9aa36a105" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 06 11:28:05 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Tue Oct 06 11:28:05 2026" }, "message": "Merge \"Skip constant planes in spatial predictor selection.\" into main" }, { "commit": "652631be0333123a69dab036f5586894fc743ea6", "tree": "94623f045699c2480bd0a9b29f82951750338534", "parents": [ "164c8e9d88cbb26a42a18b3ded155e680e07e241" ], "author": { "name": "Filippo Tedeschi", "email": "filippotedeschi98@gmail.com", "time": "Tue Oct 06 10:54:30 2026" }, "committer": { "name": "Filippo Tedeschi", "email": "filippotedeschi98@gmail.com", "time": "Tue Oct 06 10:54:30 2026" }, "message": "Fix double-free in FrameToFullCanvas() error path\n\nFrameToFullCanvas() aliased mem1.mem into full_image before the\nsecond (allow_mixed) EncodeFrame() call. If that call failed (e.g.\nOOM or progress_hook abort), the Err label freed mem1.mem and\nOptimizeSingleFrame() then freed it again through\nWebPDataClear(\u0026full_image).\n\nOnly hand the winning buffer to full_image once both candidates are\nencoded, and reset full_image on error.\n\nChange-Id: I8c7cd7d8e8657653e0f2ba18d361ad88b0647d16\n" }, { "commit": "164c8e9d88cbb26a42a18b3ded155e680e07e241", "tree": "74240523da73714871ef94b9d0e4488bdcd72779", "parents": [ "643fe49e0970a33fec8f86d99ab180e1631ff564", "f8fad33a4dd80de9791634484e9e88128a1a4272" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 06 09:57:05 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Tue Oct 06 09:57:05 2026" }, "message": "Merge \"Align colorspace alpha bit and alpha plane\" into main" }, { "commit": "56804941c987207096df7c78828414f9aa36a105", "tree": "26f0662b593d3782aaa7b7499f28f06596e221b7", "parents": [ "f8fad33a4dd80de9791634484e9e88128a1a4272" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 06 09:33:32 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 06 09:33:32 2026" }, "message": "Skip constant planes in spatial predictor selection.\n\nFold near-lossless quantization and non-exact alpha checks into\nGetPlaneDiffMask, and use a single diff_mask to skip constant planes in\nUpdateHisto, PredictionCostSpatialHistogram, GetBestPredictorForTile,\nsuper-tile histogram accumulation/resets, and subsampling entropy\nevaluation.\n\nChange-Id: Ia4642f5b8a6c222a815c1e99b8d848ec8b730fdc\n" }, { "commit": "643fe49e0970a33fec8f86d99ab180e1631ff564", "tree": "3d6394059c68f83b90ee51a662c74b6660abcab2", "parents": [ "f16c05ce7305030fff412e1ae52ac5f0bc8383ef", "f8feb2ce9c8ffdebef4aea69e0572f3524213041" ], "author": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Tue Oct 06 09:04:51 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Tue Oct 06 09:04:51 2026" }, "message": "Merge \"Fix bounds check in PNG ProcessRawProfile\" into main" }, { "commit": "f8fad33a4dd80de9791634484e9e88128a1a4272", "tree": "32f0d7a233499804c87e92373fa425e9db12efcb", "parents": [ "f16c05ce7305030fff412e1ae52ac5f0bc8383ef" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 06 09:04:04 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 06 09:04:04 2026" }, "message": "Align colorspace alpha bit and alpha plane\n\nWhen src-\u003ecolorspace had WEBP_CSP_ALPHA_BIT set while src-\u003ea was\nNULL, WebPPictureCopy, WebPPictureCrop, and WebPPictureRescale\nallocated an uninitialized destination alpha plane and attempted\nto copy or rescale from NULL. Conversely, when picture-\u003ecolorspace\nlacked WEBP_CSP_ALPHA_BIT while picture-\u003ea was non-NULL,\nWebPPictureRescale checked picture-\u003ea !\u003d NULL and attempted to\nrescale into a NULL tmp.a plane.\n\nClear WEBP_CSP_ALPHA_BIT on the destination picture when\n!src-\u003euse_argb \u0026\u0026 src-\u003ea \u003d\u003d NULL, and check tmp.a !\u003d NULL in\nWebPPictureRescale.\n\nChange-Id: Ib87b583bd3aaef4536c36d06f3e4f9329fa976d8\n" }, { "commit": "f8feb2ce9c8ffdebef4aea69e0572f3524213041", "tree": "2c4ed9590a08f1431c1bb3dd05692f276e18a455", "parents": [ "a1d89ff209ca01e7a87aca64317201890bac2749" ], "author": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Mon Oct 05 12:30:50 2026" }, "committer": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Tue Oct 06 08:20:55 2026" }, "message": "Fix bounds check in PNG ProcessRawProfile\n\nChange-Id: I083380a12a77687ccb8059ac1e319f8baa0b473b\n" }, { "commit": "f16c05ce7305030fff412e1ae52ac5f0bc8383ef", "tree": "bdc93372f5f91b5d7f7855c82b1a3a889f30ff1e", "parents": [ "87b985f8d97033e35009d4ac198f6a23199ef40e" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 06 07:43:22 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Oct 06 07:43:22 2026" }, "message": "Respect pic-\u003euse_argb when converting YUVA to ARGB\n\nWebPPictureARGBToYUVA sets pic-\u003euse_argb \u003d 0 while leaving\npic-\u003eargb non-NULL. In WebPEncode, the lossless path previously\nchecked only pic-\u003eargb \u003d\u003d NULL before calling\nWebPPictureYUVAToARGB, causing VP8LEncodeImage to encode stale\nARGB pixels instead of converting the active YUVA planes.\n\nCheck (!pic-\u003euse_argb || pic-\u003eargb \u003d\u003d NULL) before invoking\nWebPPictureYUVAToARGB in the lossless path of WebPEncode.\n\nChange-Id: I80f43dfac737649ff0f31ac090c1808b0baf5a77\n" }, { "commit": "87b985f8d97033e35009d4ac198f6a23199ef40e", "tree": "5f96a38d428f66764d74c0fbe4212ff84f7d1c03", "parents": [ "a1d89ff209ca01e7a87aca64317201890bac2749" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Mon Oct 05 09:10:51 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Mon Oct 05 12:16:57 2026" }, "message": "Validate rgb_stride against step * width\n\nImport() previously checked\nabs(rgb_stride) \u003c (import_alpha ? 4 : 3) * width.\nFor WebPPictureImportRGBX and WebPPictureImportBGRX, step is\n4 bytes per pixel while import_alpha is 0, allowing invalid\nstrides smaller than 4 * width.\n\nValidate picture dimensions with WebPValidatePicture() and\nrequire |rgb_stride| \u003e\u003d step * width.\n\nabs is not used to work with INT_MIN.\n\nChange-Id: I4f622b502ad8d8c88a715279a03734302c5ffcc6\n" }, { "commit": "b4d85eea95fcd080d5669aed26cfebfb9c086d03", "tree": "d236e9814bc748962884f07730d7fffaceeb8b6e", "parents": [ "a1d89ff209ca01e7a87aca64317201890bac2749" ], "author": { "name": "James Zern", "email": "jzern@google.com", "time": "Wed Aug 12 20:59:22 2026" }, "committer": { "name": "James Zern", "email": "jzern@google.com", "time": "Sat Oct 03 04:52:38 2026" }, "message": "rescaler: fix unsigned overflow w/extreme scaling dimensions\n\nThe accumulation done to `WebPRescaler::irow` in `WebPRescalerImport()`\nmay overflow `rescaler_t` (\u003d `uint32_t`) when many rows need to be\naccumulated due to a large resolution change, e.g., 16383x16383 -\u003e 1x1,\n64 x 128 -\u003e 524288 x 1, etc. Rather than penalize the more common\nscaling cases by making `rescaler_t` a `uint64_t`, this change detects\ncases that will overflow and uses a new `rescaler_accum_t` /\n`WebPRescaler::irow64` in that case, leaving the 32-bit path unchanged.\n\nSince this only occurs in pathological cases in e.g., fuzzing, only a C\nimplementation is added for now (`RescalerExportRowShrink64_C`).\n\nBug: 498966422, 498966814, 499740712, 514991063\nChange-Id: Idedc2fc27f7dc2822f67d6de912ddb924ad7658f\n" }, { "commit": "a1d89ff209ca01e7a87aca64317201890bac2749", "tree": "f632622d0daae6aba55af490dca24f585ba1799d", "parents": [ "91505ed91fcefa81f6c79a87a1d0740701e4e565", "9fbbd352ebf716269ac40e14843a300473547148" ], "author": { "name": "James Zern", "email": "jzern@google.com", "time": "Sat Oct 03 04:47:27 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Sat Oct 03 04:47:27 2026" }, "message": "Merge \"AllocateAndInitRescaler: set dec-\u003estatus on failure\" into main" }, { "commit": "91505ed91fcefa81f6c79a87a1d0740701e4e565", "tree": "788bda1999cea60b6aacf33bf31087c7bf511cbe", "parents": [ "f8db21050e60d7671bde5c140579c4ac17397350" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Oct 01 13:41:52 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Oct 01 13:45:30 2026" }, "message": "Pass row strides instead of width in WebPPlaneDistortion.\n\nWhen x_step \u003d\u003d 1, WebPPlaneDistortion does not copy input planes\ninto a packed temporary buffer, so src and ref retain their\noriginal src_stride and ref_stride. Passing width as both stride\narguments to metric() caused incorrect distortion calculations\nwhenever src_stride \u003e width or ref_stride \u003e width.\n\nUpdate src_stride and ref_stride to width only when x_step !\u003d 1\nand pass src_stride and ref_stride to metric().\n\nChange-Id: I587c398969dcf0abe35ae7c6ec6169a4b1425393\n" }, { "commit": "f8db21050e60d7671bde5c140579c4ac17397350", "tree": "12e6513cf82a3081ef1150d12ba0abad2ec26c1b", "parents": [ "180b2533cc3321de44b8c0f091f08402ec76c35d", "8ca4c43f883d576e810e3b069451ba25a447aff8" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Oct 01 12:27:05 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Thu Oct 01 12:27:05 2026" }, "message": "Merge \"Do not use -mno-sse* flags\" into main" }, { "commit": "180b2533cc3321de44b8c0f091f08402ec76c35d", "tree": "975a720bdab7174b78824aba610138edfa74a70e", "parents": [ "5b7441184b049d5a42d02e1a74e73b7bf21ad4a6", "809869b986b595181a9b0f9599b14445fd1f1e6c" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Oct 01 11:46:43 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Thu Oct 01 11:46:43 2026" }, "message": "Merge \"Ignore alpha plane pointer when decoding MODE_YUV buffers.\" into main" }, { "commit": "8ca4c43f883d576e810e3b069451ba25a447aff8", "tree": "7f1c3c1fa871a00e674bdcdb063f60edf39210be", "parents": [ "5b7441184b049d5a42d02e1a74e73b7bf21ad4a6" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Oct 01 11:43:48 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Oct 01 11:43:48 2026" }, "message": "Do not use -mno-sse* flags\n\nWith clang, that would break the ABI because some functions (e.g.\nfloor) return an SSE register.\nThose flags are not needed because the files are already not\nincluded.\n\nChange-Id: I647f94fd322d41c2787f77b973fc96acc5091b1d\n" }, { "commit": "5b7441184b049d5a42d02e1a74e73b7bf21ad4a6", "tree": "c89afc92bcc6bfa270d6e91da28ecbb0cd318241", "parents": [ "7aba795aaa2bd30c8f556732a3d0cc485febf4f9" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Oct 01 10:43:37 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Oct 01 10:43:37 2026" }, "message": "allocate HTreeGroup::packed_table from HuffmanTables.\n\nReplace the inline 512-byte `packed_table[HUFFMAN_PACKED_TABLE_SIZE]` array\nin `HTreeGroup` with a `HuffmanCode32*` pointer carved out of the global\n`HuffmanTables` segment linked list, reducing `sizeof(HTreeGroup)` from 568\nbytes to 64 bytes without per-group allocations.\n\nAlso bound the `HuffmanTables` segment chunk size in `ReadHuffmanCodesHelper`\nbased on `num_htree_groups` (`16 * table_size` or ~320 KB for \u003c\u003d 256 groups,\nand `52 * table_size` or ~1 MB for \u003e 256 groups) instead of\n`MAX_HUFF_IMAGE_SIZE * table_size` (~52 MB), and fix the off-by-one capacity\ncheck (`\u003e` instead of `\u003e\u003d`) in `VP8LHuffmanTablesEnsureCapacity`.\n\nChange-Id: Ia7ec942b7d003119f00f1289de940e0d248cd5f2\n" }, { "commit": "7aba795aaa2bd30c8f556732a3d0cc485febf4f9", "tree": "00497cabe390092842601e9858c2de07140ddd5d", "parents": [ "04851fb00dbb56573cd83f040a2ff73313053e6d", "c1e3103c7e7626fac6d703a2bff13330db8ac8a8" ], "author": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Thu Oct 01 09:56:39 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Thu Oct 01 09:56:39 2026" }, "message": "Merge \"Fix shifts and masks in WebPImportRGB565 and 4444\" into main" }, { "commit": "04851fb00dbb56573cd83f040a2ff73313053e6d", "tree": "291e07edb47cbfb9aa3185a421b65d5b92a8c4fb", "parents": [ "b37d309adf02293faa98eb99ccc94919aa4d5c0d", "e1c0f42b1d3c8279e58605015e599214d4a66963" ], "author": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Thu Oct 01 09:56:29 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Thu Oct 01 09:56:29 2026" }, "message": "Merge \"Validate SharpYuvOptions and prevent 32b overflow\" into main" }, { "commit": "b37d309adf02293faa98eb99ccc94919aa4d5c0d", "tree": "3f9f26a81853640f795cba38ed31920724112e42", "parents": [ "b3a9f08a253290b54181605e4cc31216eee1197a", "44b94d53dbf07405d711f8c153c59d119893bedd" ], "author": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Thu Oct 01 09:56:17 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Thu Oct 01 09:56:17 2026" }, "message": "Merge \"Fix double-free on candidate error in SetFrame()\" into main" }, { "commit": "c1e3103c7e7626fac6d703a2bff13330db8ac8a8", "tree": "bece63a6751f31dffe18c747b16bc564e4d64fbd", "parents": [ "e1c0f42b1d3c8279e58605015e599214d4a66963" ], "author": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Wed Sep 30 08:38:21 2026" }, "committer": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Wed Sep 30 08:38:21 2026" }, "message": "Fix shifts and masks in WebPImportRGB565 and 4444\n\nIn WebPImportRGB565(), the 5-bit blue channel in the low bits of gb\nwas shifted left by 5 instead of 3 and not masked to 0xf8, discarding\nits top two bits and spilling green bits into the blue and green\nchannels when combined into ARGB. In WebPImportRGB4444(), the 4-bit\ngreen and alpha channels were shifted left by 4 without masking to\n0xf0, causing the red nibble to bleed into the blue channel and the\nblue nibble to bleed into the red channel.\n\nMask the shifted channels in both functions and add exact pixel-value\nassertions in TestRGBImport.\n\nChange-Id: Iee033535976e489c57c9d99693fe3751564c1564\n" }, { "commit": "e1c0f42b1d3c8279e58605015e599214d4a66963", "tree": "0aa6cf348b883c578af2371f403ec8793838c7e9", "parents": [ "44b94d53dbf07405d711f8c153c59d119893bedd" ], "author": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Wed Sep 30 08:36:28 2026" }, "committer": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Wed Sep 30 08:36:28 2026" }, "message": "Validate SharpYuvOptions and prevent 32b overflow\n\nSharpYuvConvertWithOptions() dereferenced options before checking for\nNULL and did not validate options-\u003eyuv_matrix or bounds-check\noptions-\u003etransfer_type before indexing transfer function tables.\nSimilarly, SharpYuvEstimate420RiskImpl() checked options !\u003d NULL but\ndid not check options-\u003eyuv_matrix !\u003d NULL before dereferencing it. Add\nvalidation for these fields and add unit test coverage in\ntest_extras_api.\n\nAlso cast tmp[3] to uint64_t before summing the four 32-bit lane\naccumulators in SharpYuvUpdateY_SSE2() to avoid 32-bit unsigned\nwrap-around prior to widening to uint64_t, matching the NEON\nimplementation.\n\nChange-Id: I01f7d1f19055177c2491496dfa1ad6456a645e65\n" }, { "commit": "b3a9f08a253290b54181605e4cc31216eee1197a", "tree": "cb2d6f8fa8c285614081b63206534875108d016c", "parents": [ "8e7f95e00b8eb41d6c2c7659440cc179771d8f0a", "75f3383e6addc89c88e67876b3731ab907487312" ], "author": { "name": "James Zern", "email": "jzern@google.com", "time": "Tue Sep 29 17:45:48 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Tue Sep 29 17:45:48 2026" }, "message": "Merge \"webpdec.c: suppress error msgs when fuzzing\" into main" }, { "commit": "44b94d53dbf07405d711f8c153c59d119893bedd", "tree": "416a2aef167a75cda7b23332cb6e7603bd487aa0", "parents": [ "8e7f95e00b8eb41d6c2c7659440cc179771d8f0a" ], "author": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Tue Sep 29 15:15:17 2026" }, "committer": { "name": "Yannis Guyon", "email": "yguyon@google.com", "time": "Tue Sep 29 15:15:17 2026" }, "message": "Fix double-free on candidate error in SetFrame()\n\nIn PickBestCandidate(), the winning candidate\u0027s bitstream buffer is\naliased directly into encoded_frame-\u003ekey_frame.bitstream or\nencoded_frame-\u003esub_frame.bitstream while non-winning candidates are\nfreed immediately. If a subsequent EncodeCandidate() call within the\nsame SetFrame() invocation fails (such as when both lossless and lossy\ncandidates are evaluated and progress_hook aborts on the second\ncandidate), SetFrame()\u0027s Err cleanup freed candidates[i].mem and\nCacheFrame() then freed the aliased pointer in encoded_frame a second\ntime via FrameRelease(). Remove the redundant candidate cleanup loop\nin SetFrame() and the unused Candidate::evaluate field so\nFrameRelease() solely owns freeing the winning candidate buffer on\nerror.\n\nAlso mark curr_canvas_copy_modified after lossless EncodeCandidate()\ncalls because WebPEncode() clears the RGB channels of transparent\npixels in-place when exact\u003d0, which otherwise left modified pixels in\ncurr_canvas_copy for subsequent lossy candidate evaluation.\n\nChange-Id: Iff14173a9c2929597d17cbfaf0c5518ec39df2ef\n" }, { "commit": "809869b986b595181a9b0f9599b14445fd1f1e6c", "tree": "f6586734d775333a7175b3faba8358325a81de76", "parents": [ "8e7f95e00b8eb41d6c2c7659440cc179771d8f0a" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Sep 29 14:47:59 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Sep 29 14:47:59 2026" }, "message": "Ignore alpha plane pointer when decoding MODE_YUV buffers.\n\nCheckDecBuffer only validates u.YUVA.a, a_stride, and a_size when\nWebPIsAlphaMode(mode) is true (MODE_YUVA). When colorspace is\nMODE_YUV, an external WebPYUVABuffer may have a non-NULL a\npointer with zero a_stride or a_size.\n\nGate u.YUVA.a access on WebPIsAlphaMode(buffer-\u003ecolorspace) in\nWebPFlipBuffer, ConvertToYUVA, EmitRowsYUVA, VP8LDecodeImage,\nWebPWritePGM, and WebPWriteYUV so MODE_YUV buffers do not read,\nwrite, or flip the alpha plane.\n\nChange-Id: Ieff13ff6a1cad5069b744fe731f991ec43cfc123\n" }, { "commit": "8e7f95e00b8eb41d6c2c7659440cc179771d8f0a", "tree": "4e899c12b1e803b4e497de7d300842e4ea401460", "parents": [ "0d86c592707ce5b935ecb96932706df2e61d1e8e" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Sep 29 12:07:59 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Sep 29 12:39:31 2026" }, "message": "Implement AVX2 ConvertBGRAToRGB and BGR\n\nThis is mostly to use VP8LConvertBGRAToRGB_SSE that was unused\n\nChange-Id: I43bfef78b0ae5c8812630a54e6c48f33ef390164\n" }, { "commit": "e08dd0407846ae90890ecac8371c02f2be23dc61", "tree": "aa3e5c08eb575b260f3f9896ed19d2614950ad29", "parents": [ "ea3c97c62a63140dfcc20eb8e52cc3d8bc0a4864" ], "author": { "name": "Markus Kämmerer", "email": "markus@markus-kaemmerer.de", "time": "Tue Sep 29 10:11:09 2026" }, "committer": { "name": "Markus Kämmerer", "email": "markus@markus-kaemmerer.de", "time": "Tue Sep 29 10:11:09 2026" }, "message": "cwebp: point to -exact in the -lossless help\n\nWithout -exact, -lossless changes the RGB values of fully transparent\npixels, which is unexpected for a lossless mode. The man page says so;\nthe help output now mentions it too.\n\nBug: 567177598\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\nChange-Id: If5c2d2455dc2c41287ffb4c2d3222de70eb0a4bf\n" }, { "commit": "0d86c592707ce5b935ecb96932706df2e61d1e8e", "tree": "a98553f68d39f7171667ffd46a122b13b2e6d54e", "parents": [ "ea3c97c62a63140dfcc20eb8e52cc3d8bc0a4864" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Sep 29 09:38:30 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Sep 29 09:40:20 2026" }, "message": "Support separate U and V strides in WebPImportYUVAFromRGBA\n\nBUG: 566965145\n\nChange-Id: I7177f9b452e9bd03a622c13199fd7e178f44ea7e\n" }, { "commit": "75f3383e6addc89c88e67876b3731ab907487312", "tree": "e1668bccf889a0312fdd5907cce784a5797e2188", "parents": [ "ea3c97c62a63140dfcc20eb8e52cc3d8bc0a4864" ], "author": { "name": "James Zern", "email": "jzern@google.com", "time": "Mon Sep 28 04:31:33 2026" }, "committer": { "name": "James Zern", "email": "jzern@google.com", "time": "Mon Sep 28 22:06:05 2026" }, "message": "webpdec.c: suppress error msgs when fuzzing\n\nChange-Id: I89f1675bc0a9fed14fcd8a13db4a26e2dca68ec5\n" }, { "commit": "9fbbd352ebf716269ac40e14843a300473547148", "tree": "bcea5e6097a772485b34ca9fd187888092a44c2c", "parents": [ "ea3c97c62a63140dfcc20eb8e52cc3d8bc0a4864" ], "author": { "name": "James Zern", "email": "jzern@google.com", "time": "Mon Sep 28 17:50:06 2026" }, "committer": { "name": "James Zern", "email": "jzern@google.com", "time": "Mon Sep 28 17:50:06 2026" }, "message": "AllocateAndInitRescaler: set dec-\u003estatus on failure\n\nAvoids an assertion failure in `VP8LDecodeImage()`:\n`assert(dec-\u003estatus !\u003d VP8_STATUS_OK)`.\n\nChange-Id: I3517b338f06d4052990d25a50f9508477bdbc905\n" }, { "commit": "ea3c97c62a63140dfcc20eb8e52cc3d8bc0a4864", "tree": "5f9f0181032a4191d873f9e945e6a08e57a5d338", "parents": [ "adc5b828d703ffe50048d31ac296af082e0c2318" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Mon Sep 28 08:51:19 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Mon Sep 28 09:07:40 2026" }, "message": "Fix EmitRescaledAlphaRGB\n\nEmitRescaledRGB always imports all io-\u003emb_h luma rows of the\ncurrent macroblock.\n\nEmitRescaledAlphaRGB previously only imported alpha rows inside\nwhile (lines_left \u003e 0). When downscaling vertically,\nEmitRescaledAlphaRGB skipped importing alpha rows for those\nmacroblock rows.\n\nBUG: 566181525, 566181828\n\nChange-Id: Ia48541535a3ffd8a5ac08f4c2ec09d862c5d21b9\n" }, { "commit": "adc5b828d703ffe50048d31ac296af082e0c2318", "tree": "1a7bdd6dc33527a08748a1e3bd7da12828bfaa12", "parents": [ "0ff181e8d0b7ef41e45c1c292324828bab0a34dd" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Mon Sep 28 07:37:31 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Mon Sep 28 07:37:31 2026" }, "message": "Add WEBP_NODISCARD to functions returning error codes\n\nOverall, only one was missed in alpha_enc, but it is safe to\nignore (hence the (void)VP8BitWriterInit(\u0026score-\u003ebw, 0);)\n\nChange-Id: I8a80a00657571291915b2fa823eff8b6ad73ba59\n" }, { "commit": "0ff181e8d0b7ef41e45c1c292324828bab0a34dd", "tree": "c29336e9bb740803e2a37233b866d334a3d5f60d", "parents": [ "47f95f17201e1721ef31edb1e3c9bdbe2c95d959" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Sep 24 14:53:07 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Fri Sep 25 09:13:45 2026" }, "message": "reject truncated Huffman-table streams before allocating\n\nEach Huffman group has 5 trees, each requiring at least 4 bits in the\nbitstream (20 bits per group). Verify that the remaining unread bits in\ndec-\u003ebr can cover num_htree_groups_max before allocating code_lengths,\nhtree_groups, and huffman_tables.\n\nBUG: 550179426\nChange-Id: I87d884bd216f47789b76ac875018a19fc674dd4f\n" }, { "commit": "47f95f17201e1721ef31edb1e3c9bdbe2c95d959", "tree": "14abddac0c9e1037f07122baaa6a9925c2cb271c", "parents": [ "bb3ad5bc2440c28c5006f99d81d051460210d261" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Sep 24 14:04:03 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Sep 24 19:55:44 2026" }, "message": "Fix fuzzer timeouts in anim_util_fuzzer and imageio_fuzzer.\n\n- In anim_util_fuzzer, check for the 3-byte \u0027GIF\u0027 prefix rather\nthan only \u0027GIF87a\u0027/\u0027GIF89a\u0027 so \u0027GIFVER\u0027 inputs (accepted by IsGIF()\nand DGifOpen()) do not bypass dimension and frame-count checks,\nand return early on malformed GIF blocks instead of breaking out\ninto ReadAnimatedImage(). Also bound total WebP animation frames\nto kFuzzFrameLimit.\n- In fuzz_utils, update GetSOFData() to handle standalone JPEG\nmarkers (RST0-RST7, SOI, TEM), fill bytes, and all JPEG SOF\nmarkers (SOF0-SOF15), and extend IsImageTooBig() to check PNG\n(IHDR) and PNM header dimensions.\n- In imageio_fuzzer, check TIFF dimensions and tile sizes via\nTIFFClientOpen before invoking ReadTIFF().\n\nChange-Id: I6310fc6866bdf1330c62a820d0b13e2613445984\n" }, { "commit": "bb3ad5bc2440c28c5006f99d81d051460210d261", "tree": "c40baf4e502f8cebd0f972306dd27e57dfa1204d", "parents": [ "4391fdb07966c09f831828e2b19ec8911c5f4917" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Sep 24 11:44:44 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Sep 24 11:44:44 2026" }, "message": "use sliding window for decoded alpha rows\n\nAllocate only a sliding output row window for dec-\u003ealpha_plane in\nAllocateMemory (frame_dec.c) when alpha dithering is not active.\n\nChange-Id: I2a32c3ed493f6e097e573cf5cf0de8a9c96fcfae\n" }, { "commit": "4391fdb07966c09f831828e2b19ec8911c5f4917", "tree": "20d459167ee33436ab017cd94b50d6a56ca64da2", "parents": [ "f4c34a1d45e6d4bfb9529bcbcaba1b5376bc3bff" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Sep 23 15:51:34 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Thu Sep 24 08:49:10 2026" }, "message": "remove duplicate AllocateAlphaPlane allocation\n\nAllocateMemory in frame_dec.c already allocates dec-\u003ealpha_plane\ninside dec-\u003emem. Remove the duplicate AllocateAlphaPlane\nallocation (dec-\u003ealpha_plane_mem) in alpha_dec.c and use\nalph_dec-\u003eprev_line instead of dec-\u003ealpha_prev_line\n\nBUG: 550179426\n\nChange-Id: I5b516a56f20fa647c61a01e9d17c23a7b6973d65\n" }, { "commit": "f4c34a1d45e6d4bfb9529bcbcaba1b5376bc3bff", "tree": "1b9bbb35a6c6fbd9af0f6d46a5b1c9bbee0b2fec", "parents": [ "e7a9045111cfb6349affc37e64d6664f5f77dc93" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Sep 23 15:05:35 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Sep 23 15:05:35 2026" }, "message": "set alpha_dithering in VP8InitDithering\n\nCheck whether the alpha header uses ALPHA_PREPROCESSED_LEVELS directly in VP8InitDithering when initializing dec-\u003ealpha_dithering, instead of deferring the check to VP8DecompressAlphaRows.\n\nAlso only decode all alpha rows in one pass in VP8DecompressAlphaRows when dec-\u003ealpha_dithering \u003e 0.\n\nChange-Id: I723363f8ac482cd2419c585c68f6fb468a54926d\n" }, { "commit": "e7a9045111cfb6349affc37e64d6664f5f77dc93", "tree": "30bf094a2b8439955a1e8025983d84e16c0991a7", "parents": [ "5c168cd23b1872969c38e34b01b04dcf29849288" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Sep 22 15:38:36 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Wed Sep 23 09:13:50 2026" }, "message": "Use sliding window for lossless internal pixel buffers\n\nReplace full-height dec-\u003epixels allocations with a sliding row\nwindow bounded by the maximum VP8L backward-reference distance\nand copy length.\n\nChange-Id: I399190a7c195abc2c506ea53febca5db770a317f\n" }, { "commit": "5c168cd23b1872969c38e34b01b04dcf29849288", "tree": "491f5d2173ed29d7d2d4478a2d1549e1154aad95", "parents": [ "cd56754b26a8472dc6f9a503eb2b2790dd096f96" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Sep 22 11:57:20 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Sep 22 14:03:22 2026" }, "message": "Fix potential buffer overflow from stdin\n\nBUG: 564353367\nChange-Id: I3576b2ad76b307ff6b0a10adb86db2e8a87532be\n" }, { "commit": "cd56754b26a8472dc6f9a503eb2b2790dd096f96", "tree": "936f49aa5f9affc18afa36e400c26867495b2332", "parents": [ "13977a505203ae4e3641ce71b6a60738ad66c564" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Sep 22 11:34:17 2026" }, "committer": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Tue Sep 22 13:55:26 2026" }, "message": "anim_util_fuzzer: bound GIF and WebP animation frame allocations\n\nCheck GIF canvas, sub-image raster dimensions, and total frame canvas count\nbefore calling ReadAnimatedImageFromMemory (which calls DGifSlurp and\nAllocateFrames). For WebP animations, check canvas * frame_count as well as\nindividual frame payload dimensions via WebPDemux.\n\nChange-Id: Ia313c71679c5d172936d3e184077d2d02f171239\n" }, { "commit": "13977a505203ae4e3641ce71b6a60738ad66c564", "tree": "69ccaed7982a3e7e9ec3a52608caf258fb2932b5", "parents": [ "87d9f5535c745ad76e5a566a6819d7e079a38a28", "36f3445278282d84f79e45c9f8ebc9afb10c1dcd" ], "author": { "name": "Vincent Rabaud", "email": "vrabaud@google.com", "time": "Mon Sep 21 20:24:55 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Mon Sep 21 20:24:55 2026" }, "message": "Merge \"free unneeded huffman_image and cap Huffman table allocation\" into main" }, { "commit": "87d9f5535c745ad76e5a566a6819d7e079a38a28", "tree": "80d192520b427748c7f5cda1d5cf00cdade54e3c", "parents": [ "ea0c620525401803b2024390321a6cb1cccbfc57", "5d6ea6f89a37809535b2a1fcab8de22802a224c2" ], "author": { "name": "James Zern", "email": "jzern@google.com", "time": "Mon Sep 21 18:24:24 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Mon Sep 21 18:24:24 2026" }, "message": "Merge \"predictor_enc: skip constant planes in the residual search\" into main" }, { "commit": "ea0c620525401803b2024390321a6cb1cccbfc57", "tree": "cd1f706ed1dfff3c9a0421147ba6978d0fafa201", "parents": [ "5079d9c25fdb59119d8ec66a27f9b963d02c0fbd", "cf0a8f4638a2eb11db28b49de1ad0b6393ac4603" ], "author": { "name": "James Zern", "email": "jzern@google.com", "time": "Fri Sep 18 16:22:03 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Fri Sep 18 16:22:03 2026" }, "message": "Merge \"z-effort: spread more evenly palette+spatial efforts on -z axis\" into main" } ], "next": "36f3445278282d84f79e45c9f8ebc9afb10c1dcd" }