libwebp: cherry-pick lossless signature check improvement

92d47e4 improve VP8L signature detection by checking the version bits too

BUG=

Review URL: https://codereview.chromium.org/25563003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@226447 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 8 insertions, 6 deletions

diff --git a/third_party/libwebp/README.chromium b/third_party/libwebp/README.chromium
index 9a81604..e5a81aa 100644
--- a/third_party/libwebp/README.chromium
+++ b/third_party/libwebp/README.chromium
@@ -26,3 +26,4 @@ Cherry-picks:
   a03c351 Demux: WebPIterator now also denotes if the frame has alpha.
   6284854b Support for "Do not blend" in mux and demux libraries
   40ae352 Fix memleak in WebPIDelete()
+  92d47e4 improve VP8L signature detection by checking the version bits too
diff --git a/third_party/libwebp/dec/vp8l.c b/third_party/libwebp/dec/vp8l.c
index 89b5b4b..7c394af 100644
--- a/third_party/libwebp/dec/vp8l.c
+++ b/third_party/libwebp/dec/vp8l.c
@@ -82,20 +82,19 @@ static int DecodeImageStream(int xsize, int ysize,
 //------------------------------------------------------------------------------
 
 int VP8LCheckSignature(const uint8_t* const data, size_t size) {
-  return (size >= 1) && (data[0] == VP8L_MAGIC_BYTE);
+  return (size >= VP8L_FRAME_HEADER_SIZE &&
+          data[0] == VP8L_MAGIC_BYTE &&
+          (data[4] >> 5) == 0);  // version
 }
 
 static int ReadImageInfo(VP8LBitReader* const br,
                          int* const width, int* const height,
                          int* const has_alpha) {
-  const uint8_t signature = VP8LReadBits(br, 8);
-  if (!VP8LCheckSignature(&signature, 1)) {
-    return 0;
-  }
+  if (VP8LReadBits(br, 8) != VP8L_MAGIC_BYTE) return 0;
   *width = VP8LReadBits(br, VP8L_IMAGE_SIZE_BITS) + 1;
   *height = VP8LReadBits(br, VP8L_IMAGE_SIZE_BITS) + 1;
   *has_alpha = VP8LReadBits(br, 1);
-  VP8LReadBits(br, VP8L_VERSION_BITS);  // Read/ignore the version number.
+  if (VP8LReadBits(br, VP8L_VERSION_BITS) != 0) return 0;
   return 1;
 }
 
@@ -103,6 +102,8 @@ int VP8LGetInfo(const uint8_t* data, size_t data_size,
                 int* const width, int* const height, int* const has_alpha) {
   if (data == NULL || data_size < VP8L_FRAME_HEADER_SIZE) {
     return 0;         // not enough data
+  } else if (!VP8LCheckSignature(data, data_size)) {
+    return 0;         // bad signature
   } else {
     int w, h, a;
     VP8LBitReader br;