libwebp-0.6.0-rc1

third_party/libwebp/demux/demux.c

 // Copyright 2012 Google Inc. All Rights Reserved.
 //
 // Use of this source code is governed by a BSD-style license
 // that can be found in the COPYING file in the root of the source
 // tree. An additional intellectual property rights grant can be found
 // in the file PATENTS. All contributing project authors may
 // be found in the AUTHORS file in the root of the source tree.
 // -----------------------------------------------------------------------------
 //
 //  WebP container demux.
 //
 
 #ifdef HAVE_CONFIG_H
 #include "../webp/config.h"
 #endif
 
 #include <assert.h>
 #include <stdlib.h>
 #include <string.h>
 
 #include "../utils/utils.h"
 #include "../webp/decode.h"     // WebPGetFeatures
 #include "../webp/demux.h"
 #include "../webp/format_constants.h"
 
 #define DMUX_MAJ_VERSION 0
 #define DMUX_MIN_VERSION 3
-#define DMUX_REV_VERSION 1
+#define DMUX_REV_VERSION 2
 
 typedef struct {
   size_t start_;        // start location of the data
   size_t end_;          // end location
   size_t riff_end_;     // riff chunk end location, can be > end_.
   size_t buf_size_;     // size of the buffer
   const uint8_t* buf_;
 } MemBuffer;
 
 typedef struct {
@@ skipping 544 matching lines @@
   } else {
     if (frame->x_offset_ < 0 || frame->y_offset_ < 0) return 0;
     if (frame->width_ + frame->x_offset_ > canvas_width) return 0;
     if (frame->height_ + frame->y_offset_ > canvas_height) return 0;
   }
   return 1;
 }
 
 static int IsValidExtendedFormat(const WebPDemuxer* const dmux) {
   const int is_animation = !!(dmux->feature_flags_ & ANIMATION_FLAG);
-  const int is_fragmented = !!(dmux->feature_flags_ & FRAGMENTS_FLAG);
   const Frame* f = dmux->frames_;
 
   if (dmux->state_ == WEBP_DEMUX_PARSING_HEADER) return 1;
 
   if (dmux->canvas_width_ <= 0 || dmux->canvas_height_ <= 0) return 0;
   if (dmux->loop_count_ < 0) return 0;
   if (dmux->state_ == WEBP_DEMUX_DONE && dmux->frames_ == NULL) return 0;
-  if (is_fragmented) return 0;
+  if (dmux->feature_flags_ & ~ALL_VALID_FLAGS) return 0;  // invalid bitstream
 
   while (f != NULL) {
     const int cur_frame_set = f->frame_num_;
     int frame_count = 0;
 
     // Check frame properties.
     for (; f != NULL && f->frame_num_ == cur_frame_set; f = f->next_) {
       const ChunkData* const image = f->img_components_;
       const ChunkData* const alpha = f->img_components_ + 1;
 
@@ skipping 345 matching lines @@
         (const char*)iter->chunk.bytes - CHUNK_HEADER_SIZE;
     return SetChunk(fourcc, iter->chunk_num - 1, iter);
   }
   return 0;
 }
 
 void WebPDemuxReleaseChunkIterator(WebPChunkIterator* iter) {
   (void)iter;
 }