1 files changed, 29 insertions, 13 deletions

diff --git a/src/3rdparty/libwebp/src/utils/bit_reader.c b/src/3rdparty/libwebp/src/utils/bit_reader.c
index 64503e6..45198e1 100644
--- a/src/3rdparty/libwebp/src/utils/bit_reader.c
+++ b/src/3rdparty/libwebp/src/utils/bit_reader.c
@@ -20,17 +20,26 @@
 //------------------------------------------------------------------------------
 // VP8BitReader
 
+void VP8BitReaderSetBuffer(VP8BitReader* const br,
+                           const uint8_t* const start,
+                           size_t size) {
+  br->buf_     = start;
+  br->buf_end_ = start + size;
+  br->buf_max_ =
+      (size >= sizeof(lbit_t)) ? start + size - sizeof(lbit_t) + 1
+                               : start;
+}
+
 void VP8InitBitReader(VP8BitReader* const br,
-                      const uint8_t* const start, const uint8_t* const end) {
+                      const uint8_t* const start, size_t size) {
   assert(br != NULL);
   assert(start != NULL);
-  assert(start <= end);
+  assert(size < (1u << 31));   // limit ensured by format and upstream checks
   br->range_   = 255 - 1;
-  br->buf_     = start;
-  br->buf_end_ = end;
   br->value_   = 0;
   br->bits_    = -8;   // to load the very first 8bits
   br->eof_     = 0;
+  VP8BitReaderSetBuffer(br, start, size);
   VP8LoadNewBytes(br);
 }
 
@@ -38,6 +47,7 @@ void VP8RemapBitReader(VP8BitReader* const br, ptrdiff_t offset) {
   if (br->buf_ != NULL) {
     br->buf_ += offset;
     br->buf_end_ += offset;
+    br->buf_max_ += offset;
   }
 }
 
@@ -54,7 +64,7 @@ const uint8_t kVP8Log2Range[128] = {
 };
 
 // range = ((range - 1) << kVP8Log2Range[range]) + 1
-const range_t kVP8NewRange[128] = {
+const uint8_t kVP8NewRange[128] = {
   127, 127, 191, 127, 159, 191, 223, 127,
   143, 159, 175, 191, 207, 223, 239, 127,
   135, 143, 151, 159, 167, 175, 183, 191,
@@ -83,6 +93,8 @@ void VP8LoadFinalBytes(VP8BitReader* const br) {
     br->value_ <<= 8;
     br->bits_ += 8;
     br->eof_ = 1;
+  } else {
+    br->bits_ = 0;  // This is to avoid undefined behaviour with shifts.
   }
 }
 
@@ -136,7 +148,6 @@ void VP8LInitBitReader(VP8LBitReader* const br, const uint8_t* const start,
   br->val_ = 0;
   br->bit_pos_ = 0;
   br->eos_ = 0;
-  br->error_ = 0;
 
   if (length > sizeof(br->val_)) {
     length = sizeof(br->val_);
@@ -157,8 +168,12 @@ void VP8LBitReaderSetBuffer(VP8LBitReader* const br,
   br->buf_ = buf;
   br->len_ = len;
   // pos_ > len_ should be considered a param error.
-  br->error_ = (br->pos_ > br->len_);
-  br->eos_ = br->error_ || VP8LIsEndOfStream(br);
+  br->eos_ = (br->pos_ > br->len_) || VP8LIsEndOfStream(br);
+}
+
+static void VP8LSetEndOfStream(VP8LBitReader* const br) {
+  br->eos_ = 1;
+  br->bit_pos_ = 0;  // To avoid undefined behaviour with shifts.
 }
 
 // If not at EOS, reload up to VP8L_LBITS byte-by-byte
@@ -169,7 +184,9 @@ static void ShiftBytes(VP8LBitReader* const br) {
     ++br->pos_;
     br->bit_pos_ -= 8;
   }
-  br->eos_ = VP8LIsEndOfStream(br);
+  if (VP8LIsEndOfStream(br)) {
+    VP8LSetEndOfStream(br);
+  }
 }
 
 void VP8LDoFillBitWindow(VP8LBitReader* const br) {
@@ -182,7 +199,7 @@ void VP8LDoFillBitWindow(VP8LBitReader* const br) {
     br->bit_pos_ -= VP8L_WBITS;
     // The expression below needs a little-endian arch to work correctly.
     // This gives a large speedup for decoding speed.
-    br->val_ |= (vp8l_val_t)*(const uint32_t*)(br->buf_ + br->pos_) <<
+    br->val_ |= (vp8l_val_t)WebPMemToUint32(br->buf_ + br->pos_) <<
                 (VP8L_LBITS - VP8L_WBITS);
     br->pos_ += VP8L_LOG8_WBITS;
     return;
@@ -195,14 +212,13 @@ uint32_t VP8LReadBits(VP8LBitReader* const br, int n_bits) {
   assert(n_bits >= 0);
   // Flag an error if end_of_stream or n_bits is more than allowed limit.
   if (!br->eos_ && n_bits <= VP8L_MAX_NUM_BIT_READ) {
-    const uint32_t val =
-        (uint32_t)(br->val_ >> br->bit_pos_) & kBitMask[n_bits];
+    const uint32_t val = VP8LPrefetchBits(br) & kBitMask[n_bits];
     const int new_bits = br->bit_pos_ + n_bits;
     br->bit_pos_ = new_bits;
     ShiftBytes(br);
     return val;
   } else {
-    br->error_ = 1;
+    VP8LSetEndOfStream(br);
     return 0;
   }
 }