Merge "Properly check the data size against the end of the RIFF chunk…

…" into main
webmproject · Dec 10, 2024 · 1b4c967 · 1b4c967
2 parents da0d9c7 + 9e5ecfa
commit 1b4c967
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/src/mux/muxread.c b/src/mux/muxread.c
@@ -223,6 +223,8 @@ WebPMux* WebPMuxCreateInternal(const WebPData* bitstream, int copy_data,
   // Note this padding is historical and differs from demux.c which does not
   // pad the file size.
   riff_size = SizeWithPadding(riff_size);
+  // Make sure the whole RIFF header is available.
+  if (riff_size < RIFF_HEADER_SIZE) goto Err;
   if (riff_size > size) goto Err;
   // There's no point in reading past the end of the RIFF chunk. Note riff_size
   // includes CHUNK_HEADER_SIZE after SizeWithPadding().