Sanitize bitmaps produced by libgif

src/images/SkImageDecoder_libgif.cpp

 /*
  * Copyright 2006 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkColor.h"
 #include "SkColorPriv.h"
 #include "SkColorTable.h"
@@ skipping 167 matching lines @@
  */
 static bool skip_src_rows(GifFileType* gif, uint8_t* dst, int width, int rowsToSkip) {
     for (int i = 0; i < rowsToSkip; i++) {
         if (DGifGetLine(gif, dst, width) == GIF_ERROR) {
             return false;
         }
     }
     return true;
 }
 
+static void sanitize_indexed_bitmap(SkBitmap* bm) {

[robertphillips, 2013/12/19 20:30:38]

// Indexed GIFs with fewer then 256 color entries will sometimes index out of
bounds

[hal.canary, 2013/12/19 20:50:11]

Done.

+    if ((SkBitmap::kIndex8_Config == bm->config()) && !(bm->empty())) {
+        SkAutoLockPixels alp(*bm);
+        if (NULL != bm->getPixels()) {
+            SkColorTable* ct = bm->getColorTable();  // Index8 must have it.
+            SkASSERT(ct != NULL);
+            uint32_t count = ct->count();
+            SkASSERT(count > 0);
+            SkASSERT(count <= 0x100);
+            if (count != 0x100) {  // Full colortables can't go wrong.
+                // Count is a power of 2; asserted elsewhere.
+                uint8_t byteMask = (~(count - 1));
+                bool warning = false;
+                uint8_t* addr = static_cast<uint8_t*>(bm->getPixels());
+                int height = bm->height();
+                int width = bm->width();
+                size_t rowBytes = bm->rowBytes();
+                while (--height >= 0) {
+                    uint8_t* ptr = addr;
+                    int x = width;
+                    while (--x >= 0) {
+                        if (0 != ((*ptr) & byteMask)) {
+                            warning = true;
+                            *ptr = 0;
+                        }
+                        ++ptr;
+                    }
+                    addr += rowBytes;
+                }
+                if (warning) {
+                    gif_warning(*bm, "Index out of bounds.");
+                }
+            }
+        }
+    }
+}
+
 bool SkGIFImageDecoder::onDecode(SkStream* sk_stream, SkBitmap* bm, Mode mode) {
 #if GIFLIB_MAJOR < 5
     GifFileType* gif = DGifOpen(sk_stream, DecodeCallBackProc);
 #else
     GifFileType* gif = DGifOpen(sk_stream, DecodeCallBackProc, NULL);
 #endif
     if (NULL == gif) {
         return error_return(*bm, "DGifOpen");
     }
 
@@ skipping 84 matching lines @@
 
 
             // now we decode the colortable
             int colorCount = 0;
             {
                 // Declare colorPtr here for scope.
                 SkPMColor colorPtr[256]; // storage for worst-case
                 const ColorMapObject* cmap = find_colormap(gif);
                 SkAlphaType alphaType = kOpaque_SkAlphaType;
                 if (cmap != NULL) {
+                    SkASSERT(cmap->ColorCount == (1 << (cmap->BitsPerPixel)));
                     colorCount = cmap->ColorCount;
                     if (colorCount > 256) {
                         colorCount = 256;  // our kIndex8 can't support more
                     }
                     for (int index = 0; index < colorCount; index++) {
                         colorPtr[index] = SkPackARGB32(0xFF,
                                                        cmap->Colors[index].Red,
                                                        cmap->Colors[index].Green,
                                                        cmap->Colors[index].Blue);
                     }
@@ skipping 101 matching lines @@
                     sampler.next(scanline);
                     if (y < outHeight - 1) {
                         skip_src_rows(gif, scanline, innerWidth, sampler.srcDY() - 1);
                     }
                 }
                 // skip the rest of the rows (if any)
                 int read = (outHeight - 1) * sampler.srcDY() + sampler.srcY0() + 1;
                 SkASSERT(read <= innerHeight);
                 skip_src_rows(gif, scanline, innerWidth, innerHeight - read);
             }
+            sanitize_indexed_bitmap(bm);
             return true;
             } break;
 
         case EXTENSION_RECORD_TYPE:
 #if GIFLIB_MAJOR < 5
             if (DGifGetExtension(gif, &temp_save.Function,
                                  &extData) == GIF_ERROR) {
 #else
             if (DGifGetExtension(gif, &extFunction, &extData) == GIF_ERROR) {
 #endif
@@ skipping 24 matching lines @@
             break;
 
         case TERMINATE_RECORD_TYPE:
             break;
 
         default:    /* Should be trapped by DGifGetRecordType */
             break;
         }
     } while (recType != TERMINATE_RECORD_TYPE);
 
+    sanitize_indexed_bitmap(bm);
     return true;
 }
 
 ///////////////////////////////////////////////////////////////////////////////
 DEFINE_DECODER_CREATOR(GIFImageDecoder);
 ///////////////////////////////////////////////////////////////////////////////
 
 static bool is_gif(SkStreamRewindable* stream) {
     char buf[GIF_STAMP_LEN];
     if (stream->read(buf, GIF_STAMP_LEN) == GIF_STAMP_LEN) {
@@ skipping 16 matching lines @@
 static SkImageDecoder_DecodeReg gReg(sk_libgif_dfactory);
 
 static SkImageDecoder::Format get_format_gif(SkStreamRewindable* stream) {
     if (is_gif(stream)) {
         return SkImageDecoder::kGIF_Format;
     }
     return SkImageDecoder::kUnknown_Format;
 }
 
 static SkImageDecoder_FormatReg gFormatReg(get_format_gif);