Fix overflow caught by ASAN.

src/codec/SkBmpCodec.cpp

 /*
  * Copyright 2015 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkBmpCodec.h"
 #include "SkBmpMaskCodec.h"
 #include "SkBmpRLECodec.h"
@@ skipping 536 matching lines @@
     SkASSERT(SkCodec::kBottomUp_SkScanlineOrder == fRowOrder);
     return height - y - 1;
 }
 
 /*
  * Compute the number of colors in the color table
  */
 uint32_t SkBmpCodec::computeNumColors(uint32_t numColors) {
     // Zero is a default for maxColors
     // Also set numColors to maxColors when it is too large
-    uint32_t maxColors = 1 << fBitsPerPixel;
+    uint32_t maxColors = fBitsPerPixel >= 32 ? UINT32_MAX : 1 << fBitsPerPixel;

[msarett, 2015/12/03 20:55:22]

Can we use 0 instead of UINT32_MAX?  While you're right that this value is only
used when fBitsPerPixel <= 8 (meaning there is a color table), I'd hate to think
that we *might* try to make a color table with UINT32_MAX colors.

This fix is perfect for now, but in the longer term, we should consider only
calling this function when there actually is a color table.

     if (numColors == 0 || numColors >= maxColors) {
         return maxColors;
     }
     return numColors;
 }
 
 SkCodec::Result SkBmpCodec::onStartScanlineDecode(const SkImageInfo& dstInfo,
         const SkCodec::Options& options, SkPMColor inputColorPtr[], int* inputColorCount) {
     if (!conversion_possible(dstInfo, this->getInfo())) {
         SkCodecPrintf("Error: cannot convert input type to output type.\n");
         return kInvalidConversion;
     }
 
     return prepareToDecode(dstInfo, options, inputColorPtr, inputColorCount);
 }
 
 int SkBmpCodec::onGetScanlines(void* dst, int count, size_t rowBytes) {
     // Create a new image info representing the portion of the image to decode
     SkImageInfo rowInfo = this->dstInfo().makeWH(this->dstInfo().width(), count);
 
     // Decode the requested rows
     return this->decodeRows(rowInfo, dst, rowBytes, this->options());
 }