Libwebp 0day

[linsui]

Describe the bug SchildiChat-android uses https://github.com/zjupure/GlideWebpDecoder which uses libwebp 1.2.4. We can patch the lib by replacing https://github.com/zjupure/GlideWebpDecoder/tree/master/webp_decoder/src/main/jni/libwebp with https://github.com/webmproject/libwebp/commits/1.2.4.

To Reproduce Steps to reproduce the behavior:

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

Expected behavior A clear and concise description of what you expected to happen.

Screenshots If applicable, add screenshots to help explain your problem.

Smartphone (please complete the following information):

• Device: [e.g. Samsung S6]
• OS: [e.g. Android 6.0]

Additional context

• App version: [Look it up in Settings / Help & About. Click "Version" there to copy it. "Latest version" is not a valid version!]
• Store: [e.g. F-Droid, Google Play, SpiritCroc's F-Droid]
• Homeserver: [e.g. matrix.org]
• Related labs settings: [Have you enabled any settings in labs (which ones), and does the issue still exist when disabling these?]
• Logs have been submitted using the app's built-in bug report (/"rageshake") mechanism: [yes/no]

Upstream relevance

• Does this issue exist in Element Android?
• If this issue exists in Element Android, please also link the corresponding bug report (create a new one if it doesn't exist yet)

Add any other context about the problem here.

[licaon-kter]

ref: https://blog.isosceles.com/the-webp-0day/

[SpiritCroc]

Oh, thanks for pointing out, I'll try to get a release out tomorrow

[SpiritCroc]

We can patch the lib by replacing https://github.com/zjupure/GlideWebpDecoder/tree/master/webp_decoder/src/main/jni/libwebp with https://github.com/webmproject/libwebp/commits/1.2.4.

Is there a straightforward approach to do this without forking GlideWebpDecoder? If not, I can probably just kick that library out, the amount of additional media that the library enables us to view is rather small and shouldn't justify maintaining it if it becomes too annoying

[linsui]

I thought not. You can add it back when the lib is updated.

[SpiritCroc]

Addressed in v1.6.5.sc72 (for test builds: v1.6.5.sc72-test4).

[licaon-kter]

fyi https://gitlab.com/fdroid/fdroiddata/-/merge_requests/13782/diffs

[linsui]

GlideWebpDecoder released a new version with the updated libwebp so if you want you can add it back.