From 25eff15cb84331aeb178b2ada7e72d27e0a95ba9 Mon Sep 17 00:00:00 2001 From: Aamir Khan Date: Sun, 10 May 2015 04:02:24 +0900 Subject: [PATCH] webp: fix panic in case of invalid chunkID At the time of decoding webp file, if chunkID is not one of {'ALPH', 'VP8', 'VP8L', 'VP8X'} return errInvalidFormat Fixes golang/go#10384 Change-Id: I167909b5ddef174d161f806297a08fac6aabcf19 Reviewed-on: https://go-review.googlesource.com/9839 Reviewed-by: Nigel Tao --- riff/riff.go | 7 +++---- webp/decode.go | 3 +++ 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/riff/riff.go b/riff/riff.go index b225193..9b9f71d 100644 --- a/riff/riff.go +++ b/riff/riff.go @@ -136,11 +136,10 @@ func (z *Reader) Next() (chunkID FourCC, chunkLen uint32, chunkData io.Reader, e return FourCC{}, 0, nil, z.err } chunkID = FourCC{z.buf[0], z.buf[1], z.buf[2], z.buf[3]} - chunkLen = u32(z.buf[4:]) - z.chunkLen = chunkLen - z.padded = chunkLen&1 == 1 + z.chunkLen = u32(z.buf[4:]) + z.padded = z.chunkLen&1 == 1 z.chunkReader = &chunkReader{z} - return chunkID, chunkLen, z.chunkReader, nil + return chunkID, z.chunkLen, z.chunkReader, nil } type chunkReader struct { diff --git a/webp/decode.go b/webp/decode.go index 4a91f23..259bac6 100644 --- a/webp/decode.go +++ b/webp/decode.go @@ -144,6 +144,9 @@ func decode(r io.Reader, configOnly bool) (image.Image, image.Config, error) { }, nil } wantAlpha = true + + default: + return nil, image.Config{}, errInvalidFormat } } }