MM-31436: Upgrade dependencies (#16605)

* MM-31436: Upgrade dependencies

Ran make update-dependencies

https://mattermost.atlassian.net/browse/MM-31436

```release-note
NONE
```

* add missing dep

* fix lru marshaling

vendor/github.com/oov/psd/compress.go

@@ -20,6 +20,10 @@ const (
 	CompressionMethodZIPWithPrediction    = CompressionMethod(3)
 )
 
+var (
+	errBrokenPackBits = errors.New("psd: compressed image data seems broken")
+)
+
 // Decode decodes the compressed image data from r.
 //
 // You can pass 0 to sizeHint if unknown, but in this case may read more data than necessary from r.

vendor/github.com/oov/psd/compress.inc.js

@@ -20,6 +20,9 @@ $global['$github.com/oov/psd$'] = {
             for (var j = 0, ln = lens[i]; j < ln;) {
                 if (buf[ofs] <= 0x7f) {
                     var l = buf[ofs++] + 1;
+                    if (dest.length < d+l || ln-j-1 < l) {
+                        return false;
+                    }
                     for (var k = 0; k < l; ++k) {
                         dest[d++] = buf[ofs++];
                     }
@@ -30,7 +33,11 @@ $global['$github.com/oov/psd$'] = {
                     ofs++;
                     continue;
                 }
-                for (var k = 0, l = 256 - buf[ofs++] + 1, c = buf[ofs++]; k < l; ++k) {
+                var l = 256 - buf[ofs++] + 1;
+                if (dest.length < d+l || j+1 >= ln) {
+                    return false;
+                }
+                for (var k = 0, c = buf[ofs++]; k < l; ++k) {
                     dest[d++] = c;
                 }
                 j += 2;

vendor/github.com/oov/psd/compress_other.go

@@ -49,35 +49,45 @@ func decodePackBits(dest []byte, r io.Reader, width int, lines int, large bool)
 		n--
 	}
 	if n == 1 {
-		decodePackBitsPerLine(dest, buf, lens)
+		err = decodePackBitsPerLine(dest, buf, lens)
 		return
 	}
 
 	var wg sync.WaitGroup
+	errs := make([]error, n)
 	wg.Add(n)
 	step := lines / n
 	ofs = 0
 	for i := 1; i < n; i++ {
-		go func(dest []byte, buf []byte, lens []int) {
+		go func(index int, dest []byte, buf []byte, lens []int) {
 			defer wg.Done()
-			decodePackBitsPerLine(dest, buf, lens)
-		}(dest[ofs*width:(ofs+step)*width], buf[offsets[ofs]:offsets[ofs+step]], lens[ofs:ofs+step])
+			errs[index] = decodePackBitsPerLine(dest, buf, lens)
+		}(i-1, dest[ofs*width:(ofs+step)*width], buf[offsets[ofs]:offsets[ofs+step]], lens[ofs:ofs+step])
 		ofs += step
 	}
 	go func() {
 		defer wg.Done()
-		decodePackBitsPerLine(dest[ofs*width:], buf[offsets[ofs]:], lens[ofs:])
+		errs[n-1] = decodePackBitsPerLine(dest[ofs*width:], buf[offsets[ofs]:], lens[ofs:])
 	}()
 	wg.Wait()
+	for i := 0; i < n; i++ {
+		if errs[i] != nil {
+			err = errs[i]
+			break
+		}
+	}
 	return
 }
 
-func decodePackBitsPerLine(dest []byte, buf []byte, lens []int) {
+func decodePackBitsPerLine(dest []byte, buf []byte, lens []int) error {
 	var l int
 	for _, ln := range lens {
 		for i := 0; i < ln; {
 			if buf[i] <= 0x7f {
 				l = int(buf[i]) + 1
+				if len(dest) < l || ln-i-1 < l {
+					return errBrokenPackBits
+				}
 				copy(dest[:l], buf[i+1:])
 				dest = dest[l:]
 				i += l + 1
@@ -88,6 +98,9 @@ func decodePackBitsPerLine(dest []byte, buf []byte, lens []int) {
 				continue
 			}
 			l = int(-buf[i]) + 1
+			if len(dest) < l || i+1 >= ln {
+				return errBrokenPackBits
+			}
 			for j, c := 0, buf[i+1]; j < l; j++ {
 				dest[j] = c
 			}
@@ -96,4 +109,5 @@ func decodePackBitsPerLine(dest []byte, buf []byte, lens []int) {
 		}
 		buf = buf[ln:]
 	}
+	return nil
 }

vendor/github.com/oov/psd/compress_wasm_js.go

@@ -42,16 +42,19 @@ func decodePackBits(dest []byte, r io.Reader, width int, lines int, large bool)
 	}
 	read += l
 
-	decodePackBitsPerLine(dest, buf, lens)
+	err = decodePackBitsPerLine(dest, buf, lens)
 	return
 }
 
-func decodePackBitsPerLine(dest []byte, buf []byte, lens []int) {
+func decodePackBitsPerLine(dest []byte, buf []byte, lens []int) error {
 	var l int
 	for _, ln := range lens {
 		for i := 0; i < ln; {
 			if buf[i] <= 0x7f {
 				l = int(buf[i]) + 1
+				if len(dest) < l || ln-i-1 < l {
+					return errBrokenPackBits
+				}
 				copy(dest[:l], buf[i+1:])
 				dest = dest[l:]
 				i += l + 1
@@ -62,6 +65,9 @@ func decodePackBitsPerLine(dest []byte, buf []byte, lens []int) {
 				continue
 			}
 			l = int(-buf[i]) + 1
+			if len(dest) < l || i+1 >= ln {
+				return errBrokenPackBits
+			}
 			for j, c := 0, buf[i+1]; j < l; j++ {
 				dest[j] = c
 			}
@@ -70,4 +76,5 @@ func decodePackBitsPerLine(dest []byte, buf []byte, lens []int) {
 		}
 		buf = buf[ln:]
 	}
+	return nil
 }

vendor/github.com/oov/psd/imageres.go

@@ -41,7 +41,16 @@ func readImageResource(r io.Reader) (resMap map[int]ImageResource, read int, err
 			return nil, read, err
 		}
 		read += l
-		if string(b[:4]) != "8BIM" {
+
+		// http://fileformats.archiveteam.org/wiki/Photoshop_Image_Resources
+		// This document says:
+		// Each block usually begins with the ASCII characters "8BIM",
+		// a signature that appears in several Photoshop formats.
+		// Other block signatures that have been observed are
+		// "MeSa" (apparently associated with ImageReady),
+		// "PHUT" (apparently associated with PhotoDeluxe), "AgHg", and "DCSR".
+		sig := string(b[:4])
+		if sig != "8BIM" && sig != "MeSa" && sig != "PHUT" && sig != "AgHg" && sig != "DCSR" {
 			return nil, read, errors.New("psd: invalid image resource signature")
 		}
 

vendor/github.com/oov/psd/layer.go

@@ -149,7 +149,7 @@ func readLayerAndMaskInfo(r io.Reader, cfg *Config, o *DecodeOptions) (psd *PSD,
 				reportReaderPosition("    file offset: 0x%08x", r)
 			}
 			// TODO(oov): implement
-			if l, err = io.ReadFull(r, make([]byte, globalLayerMaskInfoLen)); err != nil {
+			if l, err = discard(r, globalLayerMaskInfoLen); err != nil {
 				return nil, read, err
 			}
 			read += l
@@ -556,7 +556,7 @@ func readLayerExtraData(r io.Reader, layer *Layer, cfg *Config, o *DecodeOptions
 			Debug.Println("  layer blending ranges data skipped:", blendingRangesLen)
 		}
 		// TODO(oov): implement
-		if l, err = io.ReadFull(r, make([]byte, blendingRangesLen)); err != nil {
+		if l, err = discard(r, blendingRangesLen); err != nil {
 			return read, err
 		}
 		read += l
@@ -747,11 +747,13 @@ func readLayerMaskAndAdjustmentLayerData(r io.Reader, layer *Layer, cfg *Config,
 
 	if maskLen == 20 {
 		// Padding. Only present if size = 20.
-		if l, err = io.ReadFull(r, b[:2]); err != nil {
-			return read, err
+		if readMask < maskLen && maskLen-readMask <= 2 {
+			if l, err = io.ReadFull(r, b[:maskLen-readMask]); err != nil {
+				return read, err
+			}
+			read += l
+			readMask += l
 		}
-		read += l
-		readMask += l
 		return read, nil
 	}
 

vendor/github.com/oov/psd/util.go

@@ -2,6 +2,7 @@ package psd
 
 import (
 	"io"
+	"io/ioutil"
 	"math"
 	"unicode/utf16"
 )
@@ -122,7 +123,8 @@ func discard(r io.Reader, skip int) (read int, err error) {
 		}
 		return skip, nil
 	default:
-		return io.ReadFull(r, make([]byte, skip))
+		rd, err := io.CopyN(ioutil.Discard, r, int64(skip))
+		return int(rd), err
 	}
 }