From 0a302c87fc583ab3e911f799f7405ba7aada4a4d Mon Sep 17 00:00:00 2001
From: "jzern@chromium.org"
 <jzern@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98>
Date: Fri, 17 Feb 2012 20:48:24 +0000
Subject: libwebp: cherry-pick some bug fixes

7bb6a9c idec: fix internal state corruption
89cd1bb idec: fix WebPIUpdate failure

BUG=112904
TEST=layout


Review URL: http://codereview.chromium.org/9341010

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@122575 0039d316-1c4b-4281-b951-d872f2087c98
---
 third_party/libwebp/README.chromium | 3 +++
 third_party/libwebp/dec/idec.c      | 4 +++-
 third_party/libwebp/dec/vp8.c       | 1 +
 3 files changed, 7 insertions(+), 1 deletion(-)

(limited to 'third_party/libwebp')

diff --git a/third_party/libwebp/README.chromium b/third_party/libwebp/README.chromium
index 58871aa..b3c2b2b 100644
--- a/third_party/libwebp/README.chromium
+++ b/third_party/libwebp/README.chromium
@@ -20,3 +20,6 @@ Local changes:
  * Removed examples/, documentation and build related files, keeping only
    the contents of src/.
  * Merged COPYING/PATENTS to LICENSE
+Upstream cherry-picks:
+7bb6a9c idec: fix internal state corruption
+89cd1bb idec: fix WebPIUpdate failure
diff --git a/third_party/libwebp/dec/idec.c b/third_party/libwebp/dec/idec.c
index 048d3c5..3c773dd 100644
--- a/third_party/libwebp/dec/idec.c
+++ b/third_party/libwebp/dec/idec.c
@@ -127,6 +127,7 @@ static int AppendToMemBuffer(WebPIDecoder* const idec,
   memcpy(mem->buf_ + mem->end_, data, data_size);
   mem->end_ += data_size;
   assert(mem->end_ <= mem->buf_size_);
+  assert(last_part >= 0);
   dec->parts_[last_part].buf_end_ = mem->buf_ + mem->end_;
 
   // note: setting up idec->io_ is only really needed at the beginning
@@ -155,6 +156,7 @@ static int RemapMemBuffer(WebPIDecoder* const idec,
       REMAP(dec->parts_[p].buf_end_, base, data);
     }
   }
+  assert(last_part >= 0);
   dec->parts_[last_part].buf_end_ = data + data_size;
 
   // Remap partition #0 data pointer to new offset.
@@ -308,12 +310,12 @@ static int CopyParts0Data(WebPIDecoder* idec) {
     }
     memcpy(part0_buf, br->buf_, psize);
     mem->part0_buf_ = part0_buf;
-    mem->start_ += psize;
     br->buf_ = part0_buf;
     br->buf_end_ = part0_buf + psize;
   } else {
     // Else: just keep pointers to the partition #0's data in dec_->br_.
   }
+  mem->start_ += psize;
   return 1;
 }
 
diff --git a/third_party/libwebp/dec/vp8.c b/third_party/libwebp/dec/vp8.c
index 9149284..af163fc 100644
--- a/third_party/libwebp/dec/vp8.c
+++ b/third_party/libwebp/dec/vp8.c
@@ -46,6 +46,7 @@ VP8Decoder* VP8New(void) {
     SetOk(dec);
     WebPWorkerInit(&dec->worker_);
     dec->ready_ = 0;
+    dec->num_parts_ = 1;
   }
   return dec;
 }
-- 
cgit v1.1