Nico Weber 7cb12e057f LibGfx/WebPLossless: Fix out-of-bounds write in color indexing transform ...

If a lossless webp has 3 or 4 colors, it uses 2 bits per pixel to
store an offset into a "color index" (which the spec explicitly does
not call palette since it says the 'color cache' is more like that).
This way, it can pack 4 pixels into a single pixel.

If the width of the output image wasn't evenly divisble by 4,
we used to write out-of-bounds in the last few columns of each
row, since we used to always write all 4 pixels.

Found by clusterfuzz. Probably fixes
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66082

While here, spruce up the comments very slightly.

2024-03-20 09:09:47 +01:00

44 KiB

Raw Blame History

View Raw