external/libgav1: backport obu parser fix | DO NOT MERGE

cl/289910031: obu: Check for size validity in SetTileDataOffset

Bug: b/147231862
Bug: b/147234020
Test: upstream test vectors, repro test case
Change-Id: I440657926b7f763484b120b76579874fb7925dca
(cherry picked from commit fd25597065d1eb70af61ef48dae263acbfca5303)
diff --git a/README.version b/README.version
index 8a3537a..5d15f7f 100644
--- a/README.version
+++ b/README.version
@@ -8,3 +8,4 @@
 - backport cl/289966078: Move initial_display_delay out of OperatingParamet
 - backport cl/290784565: Handle a change of sequence header parameters.
 - backport cl/291222461: Disallow change of sequence header during a frame.
+- backport cl/289910031: obu: Check for size validity in SetTileDataOffset
diff --git a/libgav1/src/obu_parser.cc b/libgav1/src/obu_parser.cc
index ca251fa..c4b8e94 100644
--- a/libgav1/src/obu_parser.cc
+++ b/libgav1/src/obu_parser.cc
@@ -2147,12 +2147,18 @@
   return true;
 }
 
-void ObuParser::SetTileDataOffset(size_t total_size, size_t tg_header_size,
+bool ObuParser::SetTileDataOffset(size_t total_size, size_t tg_header_size,
                                   size_t bytes_consumed_so_far) {
+  if (total_size < tg_header_size) {
+    LIBGAV1_DLOG(ERROR, "total_size (%zu) is less than tg_header_size (%zu).)",
+                 total_size, tg_header_size);
+    return false;
+  }
   auto& tile_group = tile_groups_.back();
   tile_group.data_size = total_size - tg_header_size;
   tile_group.data_offset = bytes_consumed_so_far + tg_header_size;
   tile_group.data = data_ + tile_group.data_offset;
+  return true;
 }
 
 bool ObuParser::ParseTileGroup(size_t size, size_t bytes_consumed_so_far) {
@@ -2169,8 +2175,7 @@
     tile_group.start = 0;
     tile_group.end = 0;
     if (!ValidateTileGroup()) return false;
-    SetTileDataOffset(size, 0, bytes_consumed_so_far);
-    return true;
+    return SetTileDataOffset(size, 0, bytes_consumed_so_far);
   }
   int64_t scratch;
   OBU_READ_BIT_OR_FAIL;
@@ -2183,8 +2188,7 @@
       LIBGAV1_DLOG(ERROR, "Byte alignment has non zero bits.");
       return false;
     }
-    SetTileDataOffset(size, 1, bytes_consumed_so_far);
-    return true;
+    return SetTileDataOffset(size, 1, bytes_consumed_so_far);
   }
   if (obu_headers_.back().type == kObuFrame) {
     // 6.10.1: If obu_type is equal to OBU_FRAME, it is a requirement of
@@ -2204,8 +2208,7 @@
     return false;
   }
   const size_t tg_header_size = bit_reader_->byte_offset() - start_offset;
-  SetTileDataOffset(size, tg_header_size, bytes_consumed_so_far);
-  return true;
+  return SetTileDataOffset(size, tg_header_size, bytes_consumed_so_far);
 }
 
 bool ObuParser::ParseHeader() {
diff --git a/libgav1/src/obu_parser.h b/libgav1/src/obu_parser.h
index e973433..e331e66 100644
--- a/libgav1/src/obu_parser.h
+++ b/libgav1/src/obu_parser.h
@@ -562,7 +562,7 @@
   // valid, updates next_tile_group_start_ and returns true. Otherwise,
   // returns false.
   bool ValidateTileGroup();
-  void SetTileDataOffset(size_t total_size, size_t tg_header_size,
+  bool SetTileDataOffset(size_t total_size, size_t tg_header_size,
                          size_t bytes_consumed_so_far);
   bool ParseTileGroup(size_t size, size_t bytes_consumed_so_far);  // 5.11.1.