libwebp: rollup from v0.3.0-rc6..v0.3.0

Additonally cherry picks a change from master:
  94328d6 Demux: Fix a potential memleak

This avoids a leak when parsing an improperly formatted animation file.

BUG=
TBR=cpu

Review URL: https://chromiumcodereview.appspot.com/13825013

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@196676 0039d316-1c4b-4281-b951-d872f2087c98

18 files changed, 63 insertions, 62 deletions

diff --git a/third_party/libwebp/README.chromium b/third_party/libwebp/README.chromium
index 83a6a17..f71c670 100644
--- a/third_party/libwebp/README.chromium
+++ b/third_party/libwebp/README.chromium
@@ -1,7 +1,7 @@
 Name: WebP image encoder/decoder
 Short Name: libwebp
 URL: http://developers.google.com/speed/webp
-Version: v0.3.0-rc6
+Version: v0.3.0
 License: BSD
 License File: LICENSE
 Security Critical: Yes
@@ -20,3 +20,5 @@ Local changes:
  * Removed examples/, documentation and build related files, keeping only
    the contents of src/ less mux/ which is unused.
  * Merged COPYING/PATENTS to LICENSE
+ Cherry-picks:
+   94328d6 Demux: Fix a potential memleak
diff --git a/third_party/libwebp/dec/vp8l.c b/third_party/libwebp/dec/vp8l.c
index 5659cb5..1665fe1 100644
--- a/third_party/libwebp/dec/vp8l.c
+++ b/third_party/libwebp/dec/vp8l.c
@@ -58,18 +58,18 @@ static const uint8_t kCodeLengthCodeOrder[NUM_CODE_LENGTH_CODES] = {
 
 #define CODE_TO_PLANE_CODES        120
 static const uint8_t code_to_plane_lut[CODE_TO_PLANE_CODES] = {
-   0x18, 0x07, 0x17, 0x19, 0x28, 0x06, 0x27, 0x29, 0x16, 0x1a,
-   0x26, 0x2a, 0x38, 0x05, 0x37, 0x39, 0x15, 0x1b, 0x36, 0x3a,
-   0x25, 0x2b, 0x48, 0x04, 0x47, 0x49, 0x14, 0x1c, 0x35, 0x3b,
-   0x46, 0x4a, 0x24, 0x2c, 0x58, 0x45, 0x4b, 0x34, 0x3c, 0x03,
-   0x57, 0x59, 0x13, 0x1d, 0x56, 0x5a, 0x23, 0x2d, 0x44, 0x4c,
-   0x55, 0x5b, 0x33, 0x3d, 0x68, 0x02, 0x67, 0x69, 0x12, 0x1e,
-   0x66, 0x6a, 0x22, 0x2e, 0x54, 0x5c, 0x43, 0x4d, 0x65, 0x6b,
-   0x32, 0x3e, 0x78, 0x01, 0x77, 0x79, 0x53, 0x5d, 0x11, 0x1f,
-   0x64, 0x6c, 0x42, 0x4e, 0x76, 0x7a, 0x21, 0x2f, 0x75, 0x7b,
-   0x31, 0x3f, 0x63, 0x6d, 0x52, 0x5e, 0x00, 0x74, 0x7c, 0x41,
-   0x4f, 0x10, 0x20, 0x62, 0x6e, 0x30, 0x73, 0x7d, 0x51, 0x5f,
-   0x40, 0x72, 0x7e, 0x61, 0x6f, 0x50, 0x71, 0x7f, 0x60, 0x70
+  0x18, 0x07, 0x17, 0x19, 0x28, 0x06, 0x27, 0x29, 0x16, 0x1a,
+  0x26, 0x2a, 0x38, 0x05, 0x37, 0x39, 0x15, 0x1b, 0x36, 0x3a,
+  0x25, 0x2b, 0x48, 0x04, 0x47, 0x49, 0x14, 0x1c, 0x35, 0x3b,
+  0x46, 0x4a, 0x24, 0x2c, 0x58, 0x45, 0x4b, 0x34, 0x3c, 0x03,
+  0x57, 0x59, 0x13, 0x1d, 0x56, 0x5a, 0x23, 0x2d, 0x44, 0x4c,
+  0x55, 0x5b, 0x33, 0x3d, 0x68, 0x02, 0x67, 0x69, 0x12, 0x1e,
+  0x66, 0x6a, 0x22, 0x2e, 0x54, 0x5c, 0x43, 0x4d, 0x65, 0x6b,
+  0x32, 0x3e, 0x78, 0x01, 0x77, 0x79, 0x53, 0x5d, 0x11, 0x1f,
+  0x64, 0x6c, 0x42, 0x4e, 0x76, 0x7a, 0x21, 0x2f, 0x75, 0x7b,
+  0x31, 0x3f, 0x63, 0x6d, 0x52, 0x5e, 0x00, 0x74, 0x7c, 0x41,
+  0x4f, 0x10, 0x20, 0x62, 0x6e, 0x30, 0x73, 0x7d, 0x51, 0x5f,
+  0x40, 0x72, 0x7e, 0x61, 0x6f, 0x50, 0x71, 0x7f, 0x60, 0x70
 };
 
 static int DecodeImageStream(int xsize, int ysize,
@@ -1137,9 +1137,9 @@ int VP8LDecodeHeader(VP8LDecoder* const dec, VP8Io* const io) {
   return 1;
 
  Error:
-   VP8LClear(dec);
-   assert(dec->status_ != VP8_STATUS_OK);
-   return 0;
+  VP8LClear(dec);
+  assert(dec->status_ != VP8_STATUS_OK);
+  return 0;
 }
 
 int VP8LDecodeImage(VP8LDecoder* const dec) {
diff --git a/third_party/libwebp/dec/webpi.h b/third_party/libwebp/dec/webpi.h
index 44e5744..9349fcc 100644
--- a/third_party/libwebp/dec/webpi.h
+++ b/third_party/libwebp/dec/webpi.h
@@ -61,10 +61,10 @@ typedef struct {
 } WebPHeaderStructure;
 
 // Skips over all valid chunks prior to the first VP8/VP8L frame header.
-// Returns VP8_STATUS_OK on success,
-//         VP8_STATUS_BITSTREAM_ERROR if an invalid header/chunk is found, and
-//         VP8_STATUS_NOT_ENOUGH_DATA if case of insufficient data.
-// In 'headers', compressed_size, offset, alpha_data, alpha_size and lossless
+// Returns: VP8_STATUS_OK, VP8_STATUS_BITSTREAM_ERROR (invalid header/chunk),
+// VP8_STATUS_NOT_ENOUGH_DATA (partial input) or VP8_STATUS_UNSUPPORTED_FEATURE
+// in the case of non-decodable features (animation for instance).
+// In 'headers', compressed_size, offset, alpha_data, alpha_size, and lossless
 // fields are updated appropriately upon success.
 VP8StatusCode WebPParseHeaders(WebPHeaderStructure* const headers);
 
diff --git a/third_party/libwebp/demux/demux.c b/third_party/libwebp/demux/demux.c
index 8e8ca39..dd75904 100644
--- a/third_party/libwebp/demux/demux.c
+++ b/third_party/libwebp/demux/demux.c
@@ -69,6 +69,7 @@ struct WebPDemuxer {
   uint32_t bgcolor_;
   int num_frames_;
   Frame* frames_;
+  Frame** frames_tail_;
   Chunk* chunks_;  // non-image chunks
 };
 
@@ -183,15 +184,12 @@ static void AddChunk(WebPDemuxer* const dmux, Chunk* const chunk) {
 // Add a frame to the end of the list, ensuring the last frame is complete.
 // Returns true on success, false otherwise.
 static int AddFrame(WebPDemuxer* const dmux, Frame* const frame) {
-  const Frame* last_frame = NULL;
-  Frame** f = &dmux->frames_;
-  while (*f != NULL) {
-    last_frame = *f;
-    f = &(*f)->next_;
-  }
+  const Frame* const last_frame = *dmux->frames_tail_;
   if (last_frame != NULL && !last_frame->complete_) return 0;
-  *f = frame;
+
+  *dmux->frames_tail_ = frame;
   frame->next_ = NULL;
+  dmux->frames_tail_ = &frame->next_;
   return 1;
 }
 
@@ -319,6 +317,7 @@ static ParseStatus ParseAnimationFrame(
   frame->duration_       = ReadLE24s(mem);
   frame->dispose_method_ = (WebPMuxAnimDispose)(ReadByte(mem) & 1);
   if (frame->width_ * (uint64_t)frame->height_ >= MAX_IMAGE_AREA) {
+    free(frame);
     return PARSE_ERROR;
   }
 
@@ -660,6 +659,7 @@ static void InitDemux(WebPDemuxer* const dmux, const MemBuffer* const mem) {
   dmux->bgcolor_ = 0xFFFFFFFF;  // White background by default.
   dmux->canvas_width_ = -1;
   dmux->canvas_height_ = -1;
+  dmux->frames_tail_ = &dmux->frames_;
   dmux->mem_ = *mem;
 }
 
diff --git a/third_party/libwebp/dsp/dec_neon.c b/third_party/libwebp/dsp/dec_neon.c
index 5d7cff1..5aff0d3 100644
--- a/third_party/libwebp/dsp/dec_neon.c
+++ b/third_party/libwebp/dsp/dec_neon.c
@@ -79,7 +79,7 @@ extern "C" {
   "vld4.8   {" #c1"[6], " #c2"[6], " #c3"[6], " #c4"[6]}," #b1 "," #stride"\n" \
   "vld4.8   {" #c1"[7], " #c2"[7], " #c3"[7], " #c4"[7]}," #b2 "," #stride"\n"
 
-#define STORE8x2(c1, c2, p,stride)                                             \
+#define STORE8x2(c1, c2, p, stride)                                            \
   "vst2.8   {" #c1"[0], " #c2"[0]}," #p "," #stride " \n"                      \
   "vst2.8   {" #c1"[1], " #c2"[1]}," #p "," #stride " \n"                      \
   "vst2.8   {" #c1"[2], " #c2"[2]}," #p "," #stride " \n"                      \
@@ -315,8 +315,8 @@ static void TransformTwoNEON(const int16_t* in, uint8_t* dst, int do_two) {
 }
 
 static void TransformWHT(const int16_t* in, int16_t* out) {
-  const int kStep = 32; // The store is only incrementing the pointer as if we
-                        // had stored a single byte.
+  const int kStep = 32;  // The store is only incrementing the pointer as if we
+                         // had stored a single byte.
   __asm__ volatile (
     // part 1
     // load data into q0, q1
diff --git a/third_party/libwebp/dsp/enc.c b/third_party/libwebp/dsp/enc.c
index ae2c830..a6f05a5 100644
--- a/third_party/libwebp/dsp/enc.c
+++ b/third_party/libwebp/dsp/enc.c
@@ -631,13 +631,13 @@ static int QuantizeBlock(int16_t in[16], int16_t out[16],
   for (; n < 16; ++n) {
     const int j = kZigzag[n];
     const int sign = (in[j] < 0);
-    int coeff = (sign ? -in[j] : in[j]) + mtx->sharpen_[j];
-    if (coeff > 2047) coeff = 2047;
+    const int coeff = (sign ? -in[j] : in[j]) + mtx->sharpen_[j];
     if (coeff > mtx->zthresh_[j]) {
       const int Q = mtx->q_[j];
       const int iQ = mtx->iq_[j];
       const int B = mtx->bias_[j];
       out[n] = QUANTDIV(coeff, iQ, B);
+      if (out[n] > MAX_LEVEL) out[n] = MAX_LEVEL;
       if (sign) out[n] = -out[n];
       in[j] = out[n] * Q;
       if (out[n]) last = n;
diff --git a/third_party/libwebp/dsp/enc_neon.c b/third_party/libwebp/dsp/enc_neon.c
index b5a1fba..06b6b09 100644
--- a/third_party/libwebp/dsp/enc_neon.c
+++ b/third_party/libwebp/dsp/enc_neon.c
@@ -149,8 +149,8 @@ static void ITransform(const uint8_t* ref,
 
 // Same code as dec_neon.c
 static void ITransformWHT(const int16_t* in, int16_t* out) {
-  const int kStep = 32; // The store is only incrementing the pointer as if we
-                        // had stored a single byte.
+  const int kStep = 32;  // The store is only incrementing the pointer as if we
+                         // had stored a single byte.
   __asm__ volatile (
     // part 1
     // load data into q0, q1
diff --git a/third_party/libwebp/dsp/enc_sse2.c b/third_party/libwebp/dsp/enc_sse2.c
index c4148b5..619e6c5 100644
--- a/third_party/libwebp/dsp/enc_sse2.c
+++ b/third_party/libwebp/dsp/enc_sse2.c
@@ -776,7 +776,7 @@ static int Disto16x16SSE2(const uint8_t* const a, const uint8_t* const b,
 // Simple quantization
 static int QuantizeBlockSSE2(int16_t in[16], int16_t out[16],
                              int n, const VP8Matrix* const mtx) {
-  const __m128i max_coeff_2047 = _mm_set1_epi16(2047);
+  const __m128i max_coeff_2047 = _mm_set1_epi16(MAX_LEVEL);
   const __m128i zero = _mm_setzero_si128();
   __m128i coeff0, coeff8;
   __m128i out0, out8;
@@ -812,10 +812,6 @@ static int QuantizeBlockSSE2(int16_t in[16], int16_t out[16],
   coeff0 = _mm_add_epi16(coeff0, sharpen0);
   coeff8 = _mm_add_epi16(coeff8, sharpen8);
 
-  // if (coeff > 2047) coeff = 2047
-  coeff0 = _mm_min_epi16(coeff0, max_coeff_2047);
-  coeff8 = _mm_min_epi16(coeff8, max_coeff_2047);
-
   // out = (coeff * iQ + B) >> QFIX;
   {
     // doing calculations with 32b precision (QFIX=17)
@@ -843,9 +839,14 @@ static int QuantizeBlockSSE2(int16_t in[16], int16_t out[16],
     out_04 = _mm_srai_epi32(out_04, QFIX);
     out_08 = _mm_srai_epi32(out_08, QFIX);
     out_12 = _mm_srai_epi32(out_12, QFIX);
+
     // pack result as 16b
     out0 = _mm_packs_epi32(out_00, out_04);
     out8 = _mm_packs_epi32(out_08, out_12);
+
+    // if (coeff > 2047) coeff = 2047
+    out0 = _mm_min_epi16(out0, max_coeff_2047);
+    out8 = _mm_min_epi16(out8, max_coeff_2047);
   }
 
   // get sign back (if (sign[j]) out_n = -out_n)
diff --git a/third_party/libwebp/dsp/upsampling.c b/third_party/libwebp/dsp/upsampling.c
index 91d939c..aea4964 100644
--- a/third_party/libwebp/dsp/upsampling.c
+++ b/third_party/libwebp/dsp/upsampling.c
@@ -32,7 +32,7 @@ WebPUpsampleLinePairFunc WebPUpsamplers[MODE_LAST];
 //  ([3*a +   b + 9*c + 3*d      a + 3*b + 3*c + 9*d]   [8 8]) / 16
 
 // We process u and v together stashed into 32bit (16bit each).
-#define LOAD_UV(u,v) ((u) | ((v) << 16))
+#define LOAD_UV(u, v) ((u) | ((v) << 16))
 
 #define UPSAMPLE_FUNC(FUNC_NAME, FUNC, XSTEP)                                  \
 static void FUNC_NAME(const uint8_t* top_y, const uint8_t* bottom_y,           \
diff --git a/third_party/libwebp/enc/cost.c b/third_party/libwebp/enc/cost.c
index 92e0cc7..89b60ba 100644
--- a/third_party/libwebp/enc/cost.c
+++ b/third_party/libwebp/enc/cost.c
@@ -75,7 +75,7 @@ const uint16_t VP8LevelCodes[MAX_VARIABLE_LEVEL][2] = {
 
 // fixed costs for coding levels, deduce from the coding tree.
 // This is only the part that doesn't depend on the probability state.
-const uint16_t VP8LevelFixedCosts[2048] = {
+const uint16_t VP8LevelFixedCosts[MAX_LEVEL + 1] = {
      0,  256,  256,  256,  256,  432,  618,  630,
    731,  640,  640,  828,  901,  948, 1021, 1101,
   1174, 1221, 1294, 1042, 1085, 1115, 1158, 1202,
@@ -359,7 +359,7 @@ void VP8CalculateLevelCosts(VP8Proba* const proba) {
 
   for (ctype = 0; ctype < NUM_TYPES; ++ctype) {
     for (band = 0; band < NUM_BANDS; ++band) {
-      for(ctx = 0; ctx < NUM_CTX; ++ctx) {
+      for (ctx = 0; ctx < NUM_CTX; ++ctx) {
         const uint8_t* const p = proba->coeffs_[ctype][band][ctx];
         uint16_t* const table = proba->level_cost_[ctype][band][ctx];
         const int cost_base = VP8BitCost(1, p[1]);
diff --git a/third_party/libwebp/enc/cost.h b/third_party/libwebp/enc/cost.h
index 09b75b6..e264d32 100644
--- a/third_party/libwebp/enc/cost.h
+++ b/third_party/libwebp/enc/cost.h
@@ -18,7 +18,8 @@
 extern "C" {
 #endif
 
-extern const uint16_t VP8LevelFixedCosts[2048];   // approximate cost per level
+// approximate cost per level:
+extern const uint16_t VP8LevelFixedCosts[MAX_LEVEL + 1];
 extern const uint16_t VP8EntropyCost[256];        // 8bit fixed-point log(p)
 
 // Cost of coding one event with probability 'proba'.
diff --git a/third_party/libwebp/enc/picture.c b/third_party/libwebp/enc/picture.c
index 739a7aa..1e51a8d 100644
--- a/third_party/libwebp/enc/picture.c
+++ b/third_party/libwebp/enc/picture.c
@@ -462,7 +462,6 @@ int WebPPictureRescale(WebPPicture* pic, int width, int height) {
                  (uint8_t*)tmp.argb, width, height,
                  tmp.argb_stride * 4,
                  work, 4);
-
   }
   WebPPictureFree(pic);
   free(work);
diff --git a/third_party/libwebp/enc/syntax.c b/third_party/libwebp/enc/syntax.c
index 24e008c..e81fa2b 100644
--- a/third_party/libwebp/enc/syntax.c
+++ b/third_party/libwebp/enc/syntax.c
@@ -29,7 +29,6 @@ static int IsVP8XNeeded(const VP8Encoder* const enc) {
 }
 
 static int PutPaddingByte(const WebPPicture* const pic) {
-
   const uint8_t pad_byte[1] = { 0 };
   return !!pic->writer(pad_byte, 1, pic);
 }
@@ -70,7 +69,7 @@ static WebPEncodingError PutVP8XHeader(const VP8Encoder* const enc) {
   PutLE32(vp8x + CHUNK_HEADER_SIZE,     flags);
   PutLE24(vp8x + CHUNK_HEADER_SIZE + 4, pic->width - 1);
   PutLE24(vp8x + CHUNK_HEADER_SIZE + 7, pic->height - 1);
-  if(!pic->writer(vp8x, sizeof(vp8x), pic)) {
+  if (!pic->writer(vp8x, sizeof(vp8x), pic)) {
     return VP8_ENC_ERROR_BAD_WRITE;
   }
   return VP8_ENC_OK;
diff --git a/third_party/libwebp/enc/vp8enci.h b/third_party/libwebp/enc/vp8enci.h
index 6164703..6aa3f43 100644
--- a/third_party/libwebp/enc/vp8enci.h
+++ b/third_party/libwebp/enc/vp8enci.h
@@ -55,8 +55,9 @@ enum { NUM_MB_SEGMENTS = 4,
        NUM_BANDS = 8,
        NUM_CTX = 3,
        NUM_PROBAS = 11,
-       MAX_LF_LEVELS = 64,      // Maximum loop filter level
-       MAX_VARIABLE_LEVEL = 67  // last (inclusive) level with variable cost
+       MAX_LF_LEVELS = 64,       // Maximum loop filter level
+       MAX_VARIABLE_LEVEL = 67,  // last (inclusive) level with variable cost
+       MAX_LEVEL = 2047          // max level (note: max codable is 2047 + 67)
      };
 
 typedef enum {   // Rate-distortion optimization levels
diff --git a/third_party/libwebp/enc/webpenc.c b/third_party/libwebp/enc/webpenc.c
index 5e13ddc..20fbac4 100644
--- a/third_party/libwebp/enc/webpenc.c
+++ b/third_party/libwebp/enc/webpenc.c
@@ -374,11 +374,8 @@ int WebPEncode(const WebPConfig* config, WebPPicture* pic) {
   if (!config->lossless) {
     VP8Encoder* enc = NULL;
     if (pic->y == NULL || pic->u == NULL || pic->v == NULL) {
-      if (pic->argb != NULL) {
-        if (!WebPPictureARGBToYUVA(pic, WEBP_YUV420)) return 0;
-      } else {
-        return WebPEncodingSetError(pic, VP8_ENC_ERROR_NULL_PARAMETER);
-      }
+      // Make sure we have YUVA samples.
+      if (!WebPPictureARGBToYUVA(pic, WEBP_YUV420)) return 0;
     }
 
     enc = InitVP8Encoder(config, pic);
@@ -405,8 +402,10 @@ int WebPEncode(const WebPConfig* config, WebPPicture* pic) {
     }
     ok &= DeleteVP8Encoder(enc);  // must always be called, even if !ok
   } else {
-    if (pic->argb == NULL)
-      return WebPEncodingSetError(pic, VP8_ENC_ERROR_NULL_PARAMETER);
+    // Make sure we have ARGB samples.
+    if (pic->argb == NULL && !WebPPictureYUVAToARGB(pic)) {
+      return 0;
+    }
 
     ok = VP8LEncodeImage(config, pic);  // Sets pic->error in case of problem.
   }
diff --git a/third_party/libwebp/utils/rescaler.c b/third_party/libwebp/utils/rescaler.c
index 9825dcb..61530cf 100644
--- a/third_party/libwebp/utils/rescaler.c
+++ b/third_party/libwebp/utils/rescaler.c
@@ -20,7 +20,7 @@ extern "C" {
 #endif
 
 #define RFIX 30
-#define MULT_FIX(x,y) (((int64_t)(x) * (y) + (1 << (RFIX - 1))) >> RFIX)
+#define MULT_FIX(x, y) (((int64_t)(x) * (y) + (1 << (RFIX - 1))) >> RFIX)
 
 void WebPRescalerInit(WebPRescaler* const wrk, int src_width, int src_height,
                       uint8_t* const dst, int dst_width, int dst_height,
diff --git a/third_party/libwebp/webp/encode.h b/third_party/libwebp/webp/encode.h
index 423622bd..fea8ee4 100644
--- a/third_party/libwebp/webp/encode.h
+++ b/third_party/libwebp/webp/encode.h
@@ -266,7 +266,6 @@ enum WebPEncodingError {
 
 // Main exchange structure (input samples, output bytes, statistics)
 struct WebPPicture {
-
   //   INPUT
   //////////////
   // Main flag for encoder selecting between ARGB or YUV input.
diff --git a/third_party/libwebp/webp/format_constants.h b/third_party/libwebp/webp/format_constants.h
index 8b3d677..a6f76d8 100644
--- a/third_party/libwebp/webp/format_constants.h
+++ b/third_party/libwebp/webp/format_constants.h
@@ -73,11 +73,11 @@ typedef enum {
 #define FRGM_CHUNK_SIZE    6     // Size of a FRGM chunk.
 #define VP8X_CHUNK_SIZE    10    // Size of a VP8X chunk.
 
-#define MAX_CANVAS_SIZE     (1 << 24)    // 24-bit max for VP8X width/height.
-#define MAX_IMAGE_AREA      (1ULL << 32) // 32-bit max for width x height.
-#define MAX_LOOP_COUNT      (1 << 16)    // maximum value for loop-count
-#define MAX_DURATION        (1 << 24)    // maximum duration
-#define MAX_POSITION_OFFSET (1 << 24)    // maximum frame/fragment x/y offset
+#define MAX_CANVAS_SIZE     (1 << 24)     // 24-bit max for VP8X width/height.
+#define MAX_IMAGE_AREA      (1ULL << 32)  // 32-bit max for width x height.
+#define MAX_LOOP_COUNT      (1 << 16)     // maximum value for loop-count
+#define MAX_DURATION        (1 << 24)     // maximum duration
+#define MAX_POSITION_OFFSET (1 << 24)     // maximum frame/fragment x/y offset
 
 // Maximum chunk payload is such that adding the header and padding won't
 // overflow a uint32_t.