libwebp: cherry-pick some demux changes

third_party/libwebp/demux/demux.c

 // Copyright 2012 Google Inc. All Rights Reserved.
 //
 // Use of this source code is governed by a BSD-style license
 // that can be found in the COPYING file in the root of the source
 // tree. An additional intellectual property rights grant can be found
 // in the file PATENTS. All contributing project authors may
 // be found in the AUTHORS file in the root of the source tree.
 // -----------------------------------------------------------------------------
 //
 //  WebP container demux.
@@ skipping 491 matching lines @@
     if (chunk_size > MAX_CHUNK_PAYLOAD) return PARSE_ERROR;
     if (SizeIsInvalid(mem, chunk_size_padded)) return PARSE_ERROR;
 
     switch (fourcc) {
       case MKFOURCC('V', 'P', '8', 'X'): {
         return PARSE_ERROR;
       }
       case MKFOURCC('A', 'L', 'P', 'H'):
       case MKFOURCC('V', 'P', '8', ' '):
       case MKFOURCC('V', 'P', '8', 'L'): {
+        const int has_frames = !!(dmux->feature_flags_ & ANIMATION_FLAG);

[fbarchard, 2013/11/23 01:01:57]

!! is obscure.  
const int has_frames = dmux->feature_flags_ & ANIMATION_FLAG;
will do, as long as you use boolean operators.  e.g. || has_frames.
or more conventional would be

(dmux->feature_flags_ & ANIMATION_FLAG) != 0;
or
(dmux->feature_flags_ & ANIMATION_FLAG) == ANIMATION_FLAG;

         // check that this isn't an animation (all frames should be in an ANMF).
-        if (anim_chunks > 0) return PARSE_ERROR;
+        if (anim_chunks > 0 || has_frames) return PARSE_ERROR;
 
         Rewind(mem, CHUNK_HEADER_SIZE);
         status = ParseSingleImage(dmux);
         break;
       }
       case MKFOURCC('A', 'N', 'I', 'M'): {
         if (chunk_size_padded < ANIM_CHUNK_SIZE) return PARSE_ERROR;
 
         if (MemDataSize(mem) < chunk_size_padded) {
           status = PARSE_NEED_MORE_DATA;
@@ skipping 68 matching lines @@
 
   if (dmux->canvas_width_ <= 0 || dmux->canvas_height_ <= 0) return 0;
   if (dmux->state_ == WEBP_DEMUX_DONE && frame == NULL) return 0;
 
   if (frame->width_ <= 0 || frame->height_ <= 0) return 0;
   return 1;
 }
 
 // If 'exact' is true, check that the image resolution matches the canvas.
 // If 'exact' is false, check that the x/y offsets do not exceed the canvas.
+// TODO(jzern): this is insufficient in the fragmented image case if the

[fbarchard, 2013/11/23 01:01:57]

Prefer comments start with uppercase.
This is insufficient.
Prefer a todo that indicates the action to be taken, not the problem.
A problem is best documented with a bug #.

+// expectation is that the fragments completely cover the canvas.
 static int CheckFrameBounds(const Frame* const frame, int exact,
                             int canvas_width, int canvas_height) {
   if (exact) {
     if (frame->x_offset_ != 0 || frame->y_offset_ != 0) {
       return 0;
     }
     if (frame->width_ != canvas_width || frame->height_ != canvas_height) {
       return 0;
     }
   } else {
     if (frame->x_offset_ < 0 || frame->y_offset_ < 0) return 0;
     if (frame->width_ + frame->x_offset_ > canvas_width) return 0;
     if (frame->height_ + frame->y_offset_ > canvas_height) return 0;
   }
   return 1;
 }
 
 static int IsValidExtendedFormat(const WebPDemuxer* const dmux) {
   const int has_fragments = !!(dmux->feature_flags_ & FRAGMENTS_FLAG);
   const int has_frames = !!(dmux->feature_flags_ & ANIMATION_FLAG);
   const Frame* f = dmux->frames_;
 
   if (dmux->state_ == WEBP_DEMUX_PARSING_HEADER) return 1;
 
   if (dmux->canvas_width_ <= 0 || dmux->canvas_height_ <= 0) return 0;
   if (dmux->loop_count_ < 0) return 0;
   if (dmux->state_ == WEBP_DEMUX_DONE && dmux->frames_ == NULL) return 0;
+#ifndef WEBP_EXPERIMENTAL_FEATURES
+  if (has_fragments) return 0;
+#endif
 
   while (f != NULL) {
     const int cur_frame_set = f->frame_num_;
     int frame_count = 0, fragment_count = 0;
 
     // Check frame properties and if the image is composed of fragments that
     // each fragment came from a fragment.
     for (; f != NULL && f->frame_num_ == cur_frame_set; f = f->next_) {
       const ChunkData* const image = f->img_components_;
       const ChunkData* const alpha = f->img_components_ + 1;
 
+      if (has_fragments && !f->is_fragment_) return 0;
       if (!has_fragments && f->is_fragment_) return 0;
       if (!has_frames && f->frame_num_ > 1) return 0;
+
       if (f->complete_) {
         if (alpha->size_ == 0 && image->size_ == 0) return 0;
         // Ensure alpha precedes image bitstream.
         if (alpha->size_ > 0 && alpha->offset_ > image->offset_) {
           return 0;
         }
 
         if (f->width_ <= 0 || f->height_ <= 0) return 0;
       } else {
         // There shouldn't be a partial frame in a complete file.
@@ skipping 319 matching lines @@
   return 0;
 }
 
 void WebPDemuxReleaseChunkIterator(WebPChunkIterator* iter) {
   (void)iter;
 }
 
 #if defined(__cplusplus) || defined(c_plusplus)
 }  // extern "C"
 #endif