Skip to content

Commit

Permalink
webp: disallow multiple VP8X chunks
Browse files Browse the repository at this point in the history
Per the spec, there should only be one. A malformed image containing
multiple VP8X chunks can cause unexpected memory usage, since
DecodeConfig will only parse the first chunk, which contains the canvas
size, but a subsequent chunk can indicate a significantly larger canvas,
which we will then try to allocate a buffer for.

Change-Id: I240ae76162f4293f6e6991020d18d4d3270cb9b6
Reviewed-on: https://go-review.googlesource.com/c/image/+/551416
LUCI-TryBot-Result: Go LUCI <[email protected]>
Reviewed-by: Damien Neil <[email protected]>
Auto-Submit: Roland Shoemaker <[email protected]>
  • Loading branch information
rolandshoemaker authored and gopherbot committed Dec 19, 2023
1 parent 445ab0e commit 9e190ae
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 0 deletions.
5 changes: 5 additions & 0 deletions webp/decode.go
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ func decode(r io.Reader, configOnly bool) (image.Image, image.Config, error) {
alpha []byte
alphaStride int
wantAlpha bool
seenVP8X bool
widthMinusOne uint32
heightMinusOne uint32
buf [10]byte
Expand Down Expand Up @@ -113,6 +114,10 @@ func decode(r io.Reader, configOnly bool) (image.Image, image.Config, error) {
return m, image.Config{}, err

case fccVP8X:
if seenVP8X {
return nil, image.Config{}, errInvalidFormat
}
seenVP8X = true
if chunkLen != 10 {
return nil, image.Config{}, errInvalidFormat
}
Expand Down
8 changes: 8 additions & 0 deletions webp/decode_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -271,6 +271,14 @@ func TestDecodePartitionTooLarge(t *testing.T) {
}
}

func TestDuplicateVP8X(t *testing.T) {
data := []byte{'R', 'I', 'F', 'F', 49, 0, 0, 0, 'W', 'E', 'B', 'P', 'V', 'P', '8', 'X', 10, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 'V', 'P', '8', 'X', 10, 0, 0, 0, 0x10, 0, 0, 0, 0, 0, 0, 0, 0, 0}
_, err := Decode(bytes.NewReader(data))
if err != errInvalidFormat {
t.Fatalf("unexpected error: want %q, got %q", errInvalidFormat, err)
}
}

func benchmarkDecode(b *testing.B, filename string) {
data, err := ioutil.ReadFile("../testdata/blue-purple-pink-large." + filename + ".webp")
if err != nil {
Expand Down

0 comments on commit 9e190ae

Please sign in to comment.