allow options for skip static webp decoder in android framework for C…

…VE-2023-4863
zjupure · Oct 1, 2023 · 2af0ae1 · 2af0ae1
1 parent 5f80cff
commit 2af0ae1
Show file tree

Hide file tree

Showing 4 changed files with 38 additions and 16 deletions.
diff --git a/README.md b/README.md
@@ -13,7 +13,7 @@ GlideWebpDecoder is a [Glide](https://github.com/bumptech/glide) integration lib
 
 ## Dependency Integration
 
-Library is available in jcenter. If you build with Gradle, just add the following dependencies to your `build.gradle` file.
+Library is available in MavenCentral. If you build with Gradle, just add the following dependencies to your `build.gradle` file.
 Different Glide version is corresponding to different GlideWebpDecoder due to the annotation processor compatibility. The version rule of GlideWebpDecoder is "{major_version}.{glide_version}".
 For example, if you use glide 4.16.0, the corresponding version of GlideWebpDecoder should be 2.4.4.16.0
 

diff --git a/webp_decoder/src/main/java/com/bumptech/glide/integration/webp/WebpHeaderParser.java b/webp_decoder/src/main/java/com/bumptech/glide/integration/webp/WebpHeaderParser.java
@@ -184,7 +184,7 @@ public enum WebpImageType {
          */
         WEBP_LOSSLESS(false, false),
         /**
-         * Simple Webp type (Lossless) with alpha and withoud animation
+         * Simple Webp type (Lossless) with alpha and without animation
          */
         WEBP_LOSSLESS_WITH_ALPHA(true, false),
         /**

diff --git a/webp_decoder/src/main/java/com/bumptech/glide/integration/webp/decoder/WebpDownsampler.java b/webp_decoder/src/main/java/com/bumptech/glide/integration/webp/decoder/WebpDownsampler.java
@@ -50,6 +50,9 @@ public final class WebpDownsampler {
     public static final Option<Boolean> DISABLE_DECODER = Option.memory(
             "com.bumptech.glide.integration.webp.decoder.WebpDownsampler.DisableDecoder", false);
 
+    public static final Option<Boolean> USE_SYSTEM_DECODER = Option.memory(
+            "com.bumptech.glide.integration.webp.decoder.WebpDownsampler.SystemDecoder", true);
+
     private static final Downsampler.DecodeCallbacks EMPTY_CALLBACKS = new Downsampler.DecodeCallbacks() {
         @Override
         public void onObtainBounds() {
@@ -86,29 +89,45 @@ public WebpDownsampler(List<ImageHeaderParser> parsers, DisplayMetrics displayMe
     }
 
     public boolean handles(InputStream is, Options options) throws IOException{
-        if (options.get(DISABLE_DECODER)
-            || WebpHeaderParser.sIsExtendedWebpSupported) {
-            // Android System support decode this webp, just to next decoder
+        if (options.get(DISABLE_DECODER)) {
+            // disable by user
             return false;
         }
-
+        // user can disable webp decoder from android framework by options for CVE-2023-4863 (https://github.com/advisories/GHSA-j7hp-h8jx-5ppr),
+        if (options.get(USE_SYSTEM_DECODER)) {
+            if (WebpHeaderParser.sIsExtendedWebpSupported) {
+                // Android framework support webp decoder, just to next decoder
+                return false;
+            }
+            WebpHeaderParser.WebpImageType webpType = WebpHeaderParser.getType(is, byteArrayPool);
+            // handle lossless and transparent webp below Android 4.2
+            return WebpHeaderParser.isStaticWebpType(webpType)
+                    && webpType != WebpHeaderParser.WebpImageType.WEBP_SIMPLE;
+        }
+        // force use libwebp in this library for all Android versions
         WebpHeaderParser.WebpImageType webpType = WebpHeaderParser.getType(is, byteArrayPool);
-        // handle lossless and transparent webp
-        return WebpHeaderParser.isStaticWebpType(webpType)
-                && webpType != WebpHeaderParser.WebpImageType.WEBP_SIMPLE;
+        return WebpHeaderParser.isStaticWebpType(webpType);
     }
 
     public boolean handles(ByteBuffer byteBuffer, Options options) throws IOException{
-        if (options.get(DISABLE_DECODER)
-            || WebpHeaderParser.sIsExtendedWebpSupported) {
-            // Android System support decode this webp, just to next decoder
+        if (options.get(DISABLE_DECODER)) {
+            // disable by user
             return false;
         }
-
+        // user can disable webp decoder from android framework by options for CVE-2023-4863 (https://github.com/advisories/GHSA-j7hp-h8jx-5ppr),
+        if (options.get(USE_SYSTEM_DECODER)) {
+            if (WebpHeaderParser.sIsExtendedWebpSupported) {
+                // Android framework support webp decoder, just to next decoder
+                return false;
+            }
+            WebpHeaderParser.WebpImageType webpType = WebpHeaderParser.getType(byteBuffer);
+            // handle lossless and transparent webp below Android 4.2
+            return WebpHeaderParser.isStaticWebpType(webpType)
+                    && webpType != WebpHeaderParser.WebpImageType.WEBP_SIMPLE;
+        }
+        // force use libwebp in this library for all Android versions
         WebpHeaderParser.WebpImageType webpType = WebpHeaderParser.getType(byteBuffer);
-        // handle lossless and transparent webp
-        return WebpHeaderParser.isStaticWebpType(webpType)
-                && webpType != WebpHeaderParser.WebpImageType.WEBP_SIMPLE;
+        return WebpHeaderParser.isStaticWebpType(webpType);
     }
 
 

diff --git a/webpsample/src/main/java/com/bumptech/glide/samples/webp/ImageAdapter.java b/webpsample/src/main/java/com/bumptech/glide/samples/webp/ImageAdapter.java
@@ -11,6 +11,7 @@
 
 import androidx.recyclerview.widget.RecyclerView;
 
+import com.bumptech.glide.integration.webp.decoder.WebpDownsampler;
 import com.bumptech.glide.integration.webp.decoder.WebpDrawable;
 import com.bumptech.glide.integration.webp.decoder.WebpDrawableTransformation;
 import com.bumptech.glide.load.Transformation;
@@ -106,6 +107,7 @@ private void loadImage(ImageView imageView, String url) {
                 .placeholder(R.drawable.image_loading)
                 .error(R.drawable.image_error)
                 //.set(WebpFrameLoader.FRAME_CACHE_STRATEGY, WebpFrameCacheStrategy.AUTO)
+                .set(WebpDownsampler.USE_SYSTEM_DECODER, false)
                 .into(imageView);
     }
 
@@ -119,6 +121,7 @@ private void loadImageWithTransformation(ImageView imageView, String url) {
                 .optionalTransform(mBitmapTrans)
                 .optionalTransform(WebpDrawable.class, new WebpDrawableTransformation(mBitmapTrans))
                 //.set(WebpFrameLoader.FRAME_CACHE_STRATEGY, WebpFrameCacheStrategy.AUTO)
+                .set(WebpDownsampler.USE_SYSTEM_DECODER, false)
                 .into(imageView);
     }