| commit | 3c0b9837b3e3dee0a40cc1c9da6c4e54ada8b097 | |
| author | jzern@chromium.org <jzern@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | |
| Tue, 23 Oct 2012 21:17:24 +0000 (23 21:17 +0000) | ||
| committer | jzern@chromium.org <jzern@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | |
| Tue, 23 Oct 2012 21:17:24 +0000 (23 21:17 +0000) | ||
| tree | a348955f4e61d83b1b8db98ae21028d9dacf3beb | treesnapshot (tar.gz zip) |
| parent | ec9021849520dfccf8bc2644a6148aa5e17afc4b | commitdiff |
libwebp: validate chunk size in ParseOptionalChunks
the max wasn't checked leading to a rollover case, possibly exploitable.
additionally check the RIFF size early, to avoid similar issues.
BUG=157079
Review URL: https://chromiumcodereview.appspot.com/11229048
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@163677 0039d316-1c4b-4281-b951-d872f2087c98
the max wasn't checked leading to a rollover case, possibly exploitable.
additionally check the RIFF size early, to avoid similar issues.
BUG=157079
Review URL: https://chromiumcodereview.appspot.com/11229048
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@163677 0039d316-1c4b-4281-b951-d872f2087c98
| third_party/libwebp/README.chromium | diffblobblamehistory | |
| third_party/libwebp/dec/webp.c | diffblobblamehistory |