libwebp: validate chunk size in ParseOptionalChunks
commit3c0b9837b3e3dee0a40cc1c9da6c4e54ada8b097
authorjzern@chromium.org <jzern@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98>
Tue, 23 Oct 2012 21:17:24 +0000 (23 21:17 +0000)
committerjzern@chromium.org <jzern@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98>
Tue, 23 Oct 2012 21:17:24 +0000 (23 21:17 +0000)
treea348955f4e61d83b1b8db98ae21028d9dacf3beb
parentec9021849520dfccf8bc2644a6148aa5e17afc4b
libwebp: validate chunk size in ParseOptionalChunks

the max wasn't checked leading to a rollover case, possibly exploitable.
additionally check the RIFF size early, to avoid similar issues.

BUG=157079

Review URL: https://chromiumcodereview.appspot.com/11229048

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@163677 0039d316-1c4b-4281-b951-d872f2087c98
third_party/libwebp/README.chromium
third_party/libwebp/dec/webp.c