Fix truncated webp images am: 7a3ba537f7

am: 6dc9d3e388

Change-Id: Iee519c63c1c7d7555befec8acf9464b7743328e3

2 files changed, 26 insertions, 6 deletions

diff --git a/src/codec/SkWebpCodec.cpp b/src/codec/SkWebpCodec.cpp
index a2981cac5b..fd8a1fa6ea 100644
--- a/src/codec/SkWebpCodec.cpp
+++ b/src/codec/SkWebpCodec.cpp
@@ -558,7 +558,7 @@ SkCodec::Result SkWebpCodec::onGetPixels(const SkImageInfo& dstInfo, void* dst,
         return kInvalidInput;
     }
 
-    int rowsDecoded;
+    int rowsDecoded = 0;
     SkCodec::Result result;
     switch (WebPIUpdate(idec, frame.fragment.bytes, frame.fragment.size)) {
         case VP8_STATUS_OK:
@@ -566,7 +566,10 @@ SkCodec::Result SkWebpCodec::onGetPixels(const SkImageInfo& dstInfo, void* dst,
             result = kSuccess;
             break;
         case VP8_STATUS_SUSPENDED:
-            WebPIDecGetRGB(idec, &rowsDecoded, nullptr, nullptr, nullptr);
+            if (!WebPIDecGetRGB(idec, &rowsDecoded, nullptr, nullptr, nullptr)
+                    || rowsDecoded <= 0) {
+                return kInvalidInput;
+            }
             *rowsDecodedPtr = rowsDecoded + dstY;
             result = kIncompleteInput;
             break;
diff --git a/tests/CodecTest.cpp b/tests/CodecTest.cpp
index c2043b5e69..962e7be3ea 100644
--- a/tests/CodecTest.cpp
+++ b/tests/CodecTest.cpp
@@ -388,10 +388,6 @@ static void check(skiatest::Reporter* r,
         if (supportsSubsetDecoding) {
             if (expectedResult == SkCodec::kSuccess) {
                 REPORTER_ASSERT(r, result == expectedResult);
-            } else {
-                SkASSERT(expectedResult == SkCodec::kIncompleteInput);
-                REPORTER_ASSERT(r, result == SkCodec::kIncompleteInput
-                                || result == SkCodec::kSuccess);
             }
             // Webp is the only codec that supports subsets, and it will have modified the subset
             // to have even left/top.
@@ -1524,3 +1520,24 @@ DEF_TEST(Codec_EncodeICC, r) {
     test_encode_icc(r, SkEncodedImageFormat::kJPEG, SkTransferFunctionBehavior::kIgnore);
     test_encode_icc(r, SkEncodedImageFormat::kWEBP, SkTransferFunctionBehavior::kIgnore);
 }
+
+DEF_TEST(Codec_webp_rowsDecoded, r) {
+    const char* path = "baby_tux.webp";
+    sk_sp<SkData> data(GetResourceAsData(path));
+    if (!data) {
+        return;
+    }
+
+    // Truncate this file so that the header is available but no rows can be
+    // decoded. This should create a codec but fail to decode.
+    size_t truncatedSize = 5000;
+    sk_sp<SkData> subset = SkData::MakeSubset(data.get(), 0, truncatedSize);
+    std::unique_ptr<SkCodec> codec(SkCodec::NewFromData(std::move(subset)));
+    if (!codec) {
+        ERRORF(r, "Failed to create a codec for %s truncated to only %lu bytes",
+               path, truncatedSize);
+        return;
+    }
+
+    test_info(r, codec.get(), codec->getInfo(), SkCodec::kInvalidInput, nullptr);
+}