fix: Remove attempt to free animated WebP ICC color profile data usin…

…g libwebp. (#186)
discord · Sep 23, 2024 · a150c95 · a150c95
1 parent e9c36bf
commit a150c95
Show file tree

Hide file tree

Showing 3 changed files with 32 additions and 10 deletions.
diff --git a/testdata/8202024-BGS-Headless-Horseman-OO-1200x1200-optimize.webp b/testdata/8202024-BGS-Headless-Horseman-OO-1200x1200-optimize.webp
diff --git a/webp.cpp b/webp.cpp
@@ -370,6 +370,10 @@ webp_encoder webp_encoder_create(void* buf, size_t buf_len, const void* icc, siz
  */
 size_t webp_encoder_write(webp_encoder e, const opencv_mat src, const int* opt, size_t opt_len, int delay, int blend, int dispose, int x_offset, int y_offset)
 {
+    if (!e || !e->mux) {
+        return 0;
+    }
+
     // if the source is null, finalize the animation/image and return the size of the output buffer
     if (!src) {
         if (e->frame_count == 1) {
@@ -492,7 +496,13 @@ size_t webp_encoder_write(webp_encoder e, const opencv_mat src, const int* opt,
             // Store the first frame
             WebPMuxFrameInfo first_frame;
             memset(&first_frame, 0, sizeof(WebPMuxFrameInfo));
-            WebPMuxGetFrame(e->mux, 1, &first_frame);  // Get the first frame as it was set initially
+            WebPMuxError get_frame_error = WebPMuxGetFrame(e->mux, 1, &first_frame);
+            if (get_frame_error != WEBP_MUX_OK) {
+                if (out_picture) {
+                    WebPFree(out_picture);
+                }
+                return 0;
+            }
 
             // Delete the old single-image mux and create a new one for animation
             WebPMuxDelete(e->mux);
@@ -502,7 +512,6 @@ size_t webp_encoder_write(webp_encoder e, const opencv_mat src, const int* opt,
             if (e->icc && e->icc_len > 0) {
                 WebPData icc_data = { e->icc, e->icc_len };
                 WebPMuxError mux_error = WebPMuxSetChunk(e->mux, "ICCP", &icc_data, 1);
-                WebPDataClear(&icc_data);
                 if (mux_error != WEBP_MUX_OK) {
                     if (out_picture) {
                         WebPFree(out_picture);
@@ -516,8 +525,8 @@ size_t webp_encoder_write(webp_encoder e, const opencv_mat src, const int* opt,
             anim_params.loop_count = 0;  // Infinite loop
             anim_params.bgcolor = e->bgcolor;
 
-            WebPMuxError mux_error = WebPMuxSetAnimationParams(e->mux, &anim_params);
-            if (mux_error != WEBP_MUX_OK) {
+            WebPMuxError anim_params_error = WebPMuxSetAnimationParams(e->mux, &anim_params);
+            if (anim_params_error != WEBP_MUX_OK) {
                 if (out_picture) {
                     WebPFree(out_picture);
                 }
@@ -531,8 +540,8 @@ size_t webp_encoder_write(webp_encoder e, const opencv_mat src, const int* opt,
             first_frame.y_offset = e->first_frame_y_offset;
             first_frame.dispose_method = (WebPMuxAnimDispose)e->first_frame_dispose;
             first_frame.blend_method = (WebPMuxAnimBlend)e->first_frame_blend;
-            mux_error = WebPMuxPushFrame(e->mux, &first_frame, 1);
-            if (mux_error != WEBP_MUX_OK) {
+            WebPMuxError push_frame_error = WebPMuxPushFrame(e->mux, &first_frame, 1);
+            if (push_frame_error != WEBP_MUX_OK) {
                 if (out_picture) {
                     WebPFree(out_picture);
                 }
@@ -553,8 +562,8 @@ size_t webp_encoder_write(webp_encoder e, const opencv_mat src, const int* opt,
         frame.blend_method = (WebPMuxAnimBlend)blend;
 
         // Add the frame to the mux object
-        WebPMuxError mux_error = WebPMuxPushFrame(e->mux, &frame, 1);
-        if (mux_error != WEBP_MUX_OK) {
+        WebPMuxError push_frame_error = WebPMuxPushFrame(e->mux, &frame, 1);
+        if (push_frame_error != WEBP_MUX_OK) {
             if (out_picture) {
                 WebPFree(out_picture);
             }
@@ -576,8 +585,12 @@ size_t webp_encoder_write(webp_encoder e, const opencv_mat src, const int* opt,
  */
 void webp_encoder_release(webp_encoder e)
 {
-    WebPMuxDelete(e->mux);
-    delete e;
+    if (e) {
+        if (e->mux) {
+            WebPMuxDelete(e->mux);
+        }
+        delete e;
+    }
 }
 
 /**

diff --git a/webp_test.go b/webp_test.go
@@ -289,6 +289,15 @@ func testNewWebpEncoderWithAnimatedWebPSource(t *testing.T) {
 			resizeMethod:          ImageOpsFit,
 			disableAnimatedOutput: true,
 		},
+		{
+			name:         "Animated WebP - Crashing input",
+			inputPath:    "testdata/8202024-BGS-Headless-Horseman-OO-1200x1200-optimize.webp",
+			outputPath:   "testdata/out/8202024-BGS-Headless-Horseman-OO-1200x1200-optimize_out.webp",
+			width:        200,
+			height:       200,
+			quality:      60,
+			resizeMethod: ImageOpsFit,
+		},
 	}
 
 	for _, tc := range testCases {