3 files changed, 7 insertions, 1 deletions
diff --git a/third_party/libwebp/README.chromium b/third_party/libwebp/README.chromium
index 58871aa..b3c2b2b 100644
--- a/third_party/libwebp/README.chromium
+++ b/third_party/libwebp/README.chromium
@@ -20,3 +20,6 @@ Local changes:
  * Removed examples/, documentation and build related files, keeping only
    the contents of src/.
  * Merged COPYING/PATENTS to LICENSE
+Upstream cherry-picks:
+7bb6a9c idec: fix internal state corruption
+89cd1bb idec: fix WebPIUpdate failure
diff --git a/third_party/libwebp/dec/idec.c b/third_party/libwebp/dec/idec.c
index 048d3c5..3c773dd 100644
--- a/third_party/libwebp/dec/idec.c
+++ b/third_party/libwebp/dec/idec.c
@@ -127,6 +127,7 @@ static int AppendToMemBuffer(WebPIDecoder* const idec,
   memcpy(mem->buf_ + mem->end_, data, data_size);
   mem->end_ += data_size;
   assert(mem->end_ <= mem->buf_size_);
+  assert(last_part >= 0);
   dec->parts_[last_part].buf_end_ = mem->buf_ + mem->end_;
 
   // note: setting up idec->io_ is only really needed at the beginning
@@ -155,6 +156,7 @@ static int RemapMemBuffer(WebPIDecoder* const idec,
       REMAP(dec->parts_[p].buf_end_, base, data);
     }
   }
+  assert(last_part >= 0);
   dec->parts_[last_part].buf_end_ = data + data_size;
 
   // Remap partition #0 data pointer to new offset.
@@ -308,12 +310,12 @@ static int CopyParts0Data(WebPIDecoder* idec) {
     }
     memcpy(part0_buf, br->buf_, psize);
     mem->part0_buf_ = part0_buf;
-    mem->start_ += psize;
     br->buf_ = part0_buf;
     br->buf_end_ = part0_buf + psize;
   } else {
     // Else: just keep pointers to the partition #0's data in dec_->br_.
   }
+  mem->start_ += psize;
   return 1;
 }
 
diff --git a/third_party/libwebp/dec/vp8.c b/third_party/libwebp/dec/vp8.c
index 9149284..af163fc 100644
--- a/third_party/libwebp/dec/vp8.c
+++ b/third_party/libwebp/dec/vp8.c
@@ -46,6 +46,7 @@ VP8Decoder* VP8New(void) {
     SetOk(dec);
     WebPWorkerInit(&dec->worker_);
     dec->ready_ = 0;
+    dec->num_parts_ = 1;
   }
   return dec;
 }