Update to new stable branch 1750

This also includes an updated ninja and chromium dependencies
needed on Windows.

Change-Id: Icd597d80ed3fa4425933c9f1334c3c2e31291c42
Reviewed-by: Zoltan Arvai <zarvai@inf.u-szeged.hu>
Reviewed-by: Zeno Albisser <zeno.albisser@digia.com>

5 files changed, 25 insertions, 10 deletions

diff --git a/chromium/third_party/libwebp/OWNERS b/chromium/third_party/libwebp/OWNERS
index 082e6262890..37501d8ee0c 100644
--- a/chromium/third_party/libwebp/OWNERS
+++ b/chromium/third_party/libwebp/OWNERS
@@ -1 +1,2 @@
 fbarchard@chromium.org
+urvang@google.com
diff --git a/chromium/third_party/libwebp/README.chromium b/chromium/third_party/libwebp/README.chromium
index 9a81604ac21..460e9e00bc6 100644
--- a/chromium/third_party/libwebp/README.chromium
+++ b/chromium/third_party/libwebp/README.chromium
@@ -26,3 +26,8 @@ Cherry-picks:
   a03c351 Demux: WebPIterator now also denotes if the frame has alpha.
   6284854b Support for "Do not blend" in mux and demux libraries
   40ae352 Fix memleak in WebPIDelete()
+  92d47e4 improve VP8L signature detection by checking the version bits too
+  dde91fd Demux: Correct the extended format validation
+  96ad0e0 VPLBitReader: Catch error if bit_pos > LBITS.
+  e18e667 demux: strictly enforce the animation flag
+  61cb884 demux: (non-exp) fail if the fragmented flag is set
diff --git a/chromium/third_party/libwebp/dec/vp8l.c b/chromium/third_party/libwebp/dec/vp8l.c
index 89b5b4bf6e0..7c394afd320 100644
--- a/chromium/third_party/libwebp/dec/vp8l.c
+++ b/chromium/third_party/libwebp/dec/vp8l.c
@@ -82,20 +82,19 @@ static int DecodeImageStream(int xsize, int ysize,
 //------------------------------------------------------------------------------
 
 int VP8LCheckSignature(const uint8_t* const data, size_t size) {
-  return (size >= 1) && (data[0] == VP8L_MAGIC_BYTE);
+  return (size >= VP8L_FRAME_HEADER_SIZE &&
+          data[0] == VP8L_MAGIC_BYTE &&
+          (data[4] >> 5) == 0);  // version
 }
 
 static int ReadImageInfo(VP8LBitReader* const br,
                          int* const width, int* const height,
                          int* const has_alpha) {
-  const uint8_t signature = VP8LReadBits(br, 8);
-  if (!VP8LCheckSignature(&signature, 1)) {
-    return 0;
-  }
+  if (VP8LReadBits(br, 8) != VP8L_MAGIC_BYTE) return 0;
   *width = VP8LReadBits(br, VP8L_IMAGE_SIZE_BITS) + 1;
   *height = VP8LReadBits(br, VP8L_IMAGE_SIZE_BITS) + 1;
   *has_alpha = VP8LReadBits(br, 1);
-  VP8LReadBits(br, VP8L_VERSION_BITS);  // Read/ignore the version number.
+  if (VP8LReadBits(br, VP8L_VERSION_BITS) != 0) return 0;
   return 1;
 }
 
@@ -103,6 +102,8 @@ int VP8LGetInfo(const uint8_t* data, size_t data_size,
                 int* const width, int* const height, int* const has_alpha) {
   if (data == NULL || data_size < VP8L_FRAME_HEADER_SIZE) {
     return 0;         // not enough data
+  } else if (!VP8LCheckSignature(data, data_size)) {
+    return 0;         // bad signature
   } else {
     int w, h, a;
     VP8LBitReader br;
diff --git a/chromium/third_party/libwebp/demux/demux.c b/chromium/third_party/libwebp/demux/demux.c
index 1d765c74c21..c6e4acdcb86 100644
--- a/chromium/third_party/libwebp/demux/demux.c
+++ b/chromium/third_party/libwebp/demux/demux.c
@@ -509,8 +509,9 @@ static ParseStatus ParseVP8X(WebPDemuxer* const dmux) {
       case MKFOURCC('A', 'L', 'P', 'H'):
       case MKFOURCC('V', 'P', '8', ' '):
       case MKFOURCC('V', 'P', '8', 'L'): {
+        const int has_frames = !!(dmux->feature_flags_ & ANIMATION_FLAG);
         // check that this isn't an animation (all frames should be in an ANMF).
-        if (anim_chunks > 0) return PARSE_ERROR;
+        if (anim_chunks > 0 || has_frames) return PARSE_ERROR;
 
         Rewind(mem, CHUNK_HEADER_SIZE);
         status = ParseSingleImage(dmux);
@@ -599,6 +600,8 @@ static int IsValidSimpleFormat(const WebPDemuxer* const dmux) {
 
 // If 'exact' is true, check that the image resolution matches the canvas.
 // If 'exact' is false, check that the x/y offsets do not exceed the canvas.
+// TODO(jzern): this is insufficient in the fragmented image case if the
+// expectation is that the fragments completely cover the canvas.
 static int CheckFrameBounds(const Frame* const frame, int exact,
                             int canvas_width, int canvas_height) {
   if (exact) {
@@ -619,15 +622,18 @@ static int CheckFrameBounds(const Frame* const frame, int exact,
 static int IsValidExtendedFormat(const WebPDemuxer* const dmux) {
   const int has_fragments = !!(dmux->feature_flags_ & FRAGMENTS_FLAG);
   const int has_frames = !!(dmux->feature_flags_ & ANIMATION_FLAG);
-  const Frame* f;
+  const Frame* f = dmux->frames_;
 
   if (dmux->state_ == WEBP_DEMUX_PARSING_HEADER) return 1;
 
   if (dmux->canvas_width_ <= 0 || dmux->canvas_height_ <= 0) return 0;
   if (dmux->loop_count_ < 0) return 0;
   if (dmux->state_ == WEBP_DEMUX_DONE && dmux->frames_ == NULL) return 0;
+#ifndef WEBP_EXPERIMENTAL_FEATURES
+  if (has_fragments) return 0;
+#endif
 
-  for (f = dmux->frames_; f != NULL; f = f->next_) {
+  while (f != NULL) {
     const int cur_frame_set = f->frame_num_;
     int frame_count = 0, fragment_count = 0;
 
@@ -637,8 +643,10 @@ static int IsValidExtendedFormat(const WebPDemuxer* const dmux) {
       const ChunkData* const image = f->img_components_;
       const ChunkData* const alpha = f->img_components_ + 1;
 
+      if (has_fragments && !f->is_fragment_) return 0;
       if (!has_fragments && f->is_fragment_) return 0;
       if (!has_frames && f->frame_num_ > 1) return 0;
+
       if (f->complete_) {
         if (alpha->size_ == 0 && image->size_ == 0) return 0;
         // Ensure alpha precedes image bitstream.
diff --git a/chromium/third_party/libwebp/utils/bit_reader.c b/chromium/third_party/libwebp/utils/bit_reader.c
index ab7a8273ea7..677fa01b33a 100644
--- a/chromium/third_party/libwebp/utils/bit_reader.c
+++ b/chromium/third_party/libwebp/utils/bit_reader.c
@@ -179,7 +179,7 @@ void VP8LFillBitWindow(VP8LBitReader* const br) {
     }
 #endif
     ShiftBytes(br);       // Slow path.
-    if (br->pos_ == br->len_ && br->bit_pos_ == LBITS) {
+    if (br->pos_ == br->len_ && br->bit_pos_ >= LBITS) {
       br->eos_ = 1;
     }
   }