Question about WebPImage::inject_VP8X

[kevinbackhouse]

Does anybody here know why this -1 adjustment is needed in WebPImage::inject_VP8X?

exiv2/src/webpimage.cpp

Line 764 in a5c521e

int w = width - 1;

Most of the time, it looks like it's cancelling the corresponding +1 adjustments in WebPImage::doWriteMetadata, like this one:

exiv2/src/webpimage.cpp

Line 267 in a5c521e

width = Exiv2::getULong(size_buf, littleEndian) + 1;

But there's no +1 adjustment here:

exiv2/src/webpimage.cpp

Line 215 in a5c521e

width = Exiv2::getUShort(size_buf, littleEndian) & 0x3fff;

Which means that I can create a poc that causes w to be negative in WebPImage::inject_VP8X. Is that a bug? To run the poc:

exiv2 rm poc.webp

Nothing visibly bad happens. You need to set a breakpoint in WebPImage::inject_VP8X to see that w == -1.

[piponazo]

No idea from my side 😅

[neheb]

width being negative sounds like a bug 🤷