Exploiting the libwebp Vulnerability, Part 1: Playing with Huffman Code

diff --git a/src/dec/vp8l_dec.c b/src/dec/vp8l_dec.c index 45012162..06b142bc 100644 --- a/src/dec/vp8l_dec.c +++ b/src/dec/vp8l_dec.c @@ -438,6 +438,7 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize, goto Error; } + bound = &huffman_tables[num_htree_groups * table_size]; huffman_table = huffman_tables; for (i = 0; i < num_htree_groups_max; ++i) { // If the index "i" is unused in the Huffman image, just make sure the diff --git a/src/utils/huffman_utils.c b/src/utils/huffman_utils.c index 90c2fbf7..13054715 100644 --- a/src/utils/huffman_utils.c +++ b/src/utils/huffman_utils.c @@ -191,6 +191,7 @@ static int BuildHuffmanTable(HuffmanCode* const root_table, int root_bits, } code.bits = (uint8_t)(len - root_bits); code.value = (uint16_t)sorted[symbol++]; + if…