Change the BMP decoder to not reject paletted images which use color indexes

Source/platform/image-decoders/bmp/BMPImageReader.cpp

 /*
  * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 26 matching lines @@
     : m_parent(parent)
     , m_buffer(0)
     , m_decodedOffset(decodedAndHeaderOffset)
     , m_headerOffset(decodedAndHeaderOffset)
     , m_imgDataOffset(imgDataOffset)
     , m_isOS21x(false)
     , m_isOS22x(false)
     , m_isTopDown(false)
     , m_needToProcessBitmasks(false)
     , m_needToProcessColorTable(false)
-    , m_tableSizeInBytes(0)
     , m_seenNonZeroAlphaPixel(false)
     , m_seenZeroAlphaPixel(false)
     , m_andMaskState(usesAndMask ? NotYetDecoded : None)
 {
     // Clue-in decodeBMP() that we need to detect the correct info header size.
     memset(&m_infoHeader, 0, sizeof(m_infoHeader));
 }
 
 bool BMPImageReader::decodeBMP(bool onlySize)
 {
@@ skipping 402 matching lines @@
             m_bitShiftsRight[i] -= m_bitShiftsLeft[i];
             m_bitShiftsLeft[i] = 0;
         }
     }
 
     return true;
 }
 
 bool BMPImageReader::processColorTable()
 {
-    m_tableSizeInBytes = m_infoHeader.biClrUsed * (m_isOS21x ? 3 : 4);
+    size_t tableSizeInBytes = m_infoHeader.biClrUsed * (m_isOS21x ? 3 : 4);
 
     // Fail if we don't have enough file space for the color table.
-    if (((m_headerOffset + m_infoHeader.biSize + m_tableSizeInBytes) < (m_headerOffset + m_infoHeader.biSize)) || (m_imgDataOffset && (m_imgDataOffset < (m_headerOffset + m_infoHeader.biSize + m_tableSizeInBytes))))
+    if (((m_headerOffset + m_infoHeader.biSize + tableSizeInBytes) < (m_headerOffset + m_infoHeader.biSize)) || (m_imgDataOffset && (m_imgDataOffset < (m_headerOffset + m_infoHeader.biSize + tableSizeInBytes))))
         return m_parent->setFailed();
 
     // Read color table.
-    if ((m_decodedOffset > m_data->size()) || ((m_data->size() - m_decodedOffset) < m_tableSizeInBytes))
+    if ((m_decodedOffset > m_data->size()) || ((m_data->size() - m_decodedOffset) < tableSizeInBytes))
         return false;
     m_colorTable.resize(m_infoHeader.biClrUsed);
     for (size_t i = 0; i < m_infoHeader.biClrUsed; ++i) {
         m_colorTable[i].rgbBlue = m_data->data()[m_decodedOffset++];
         m_colorTable[i].rgbGreen = m_data->data()[m_decodedOffset++];
         m_colorTable[i].rgbRed = m_data->data()[m_decodedOffset++];
         // Skip padding byte (not present on OS/2 1.x).
         if (!m_isOS21x)
             ++m_decodedOffset;
     }
@@ skipping 120 matching lines @@
                 m_decodedOffset += 4;
             } else {
                 // RLE8 has one color index that gets repeated; RLE4 has two
                 // color indexes in the upper and lower 4 bits of the byte,
                 // which are alternated.
                 size_t colorIndexes[2] = {code, code};
                 if (m_infoHeader.biCompression == RLE4) {
                     colorIndexes[0] = (colorIndexes[0] >> 4) & 0xf;
                     colorIndexes[1] &= 0xf;
                 }
-                if ((colorIndexes[0] >= m_infoHeader.biClrUsed) || (colorIndexes[1] >= m_infoHeader.biClrUsed))
-                    return m_parent->setFailed();
                 for (int which = 0; m_coord.x() < endX; ) {
-                    setI(colorIndexes[which]);
+                    // Some images specify color values past the end of the
+                    // color table; set these pixels to black.
+                    if (colorIndexes[which] < m_infoHeader.biClrUsed)
+                        setI(colorIndexes[which]);
+                    else
+                        setRGBA(0, 0, 0, 255);
                     which = !which;
                 }
 
                 m_decodedOffset += 2;
             }
         }
     }
 }
 
 BMPImageReader::ProcessingResult BMPImageReader::processNonRLEData(bool inRLE, int numPixels)
@@ skipping 40 matching lines @@
                         // operation as an RGBA image, so where the AND values
                         // are 1, we simply set the framebuffer pixels to fully
                         // transparent, on the assumption that most ICOs on the
                         // web will not be doing a lot of inverting.
                         if (colorIndex) {
                             setRGBA(0, 0, 0, 0);
                             m_buffer->setHasAlpha(true);
                         } else
                             m_coord.move(1, 0);
                     } else {
-                        if (colorIndex >= m_infoHeader.biClrUsed)
-                            return Failure;
-                        setI(colorIndex);
+                        // See comments near the end of processRLEData().
+                        if (colorIndex < m_infoHeader.biClrUsed)
+                            setI(colorIndex);
+                        else
+                            setRGBA(0, 0, 0, 255);
                     }
                     pixelData <<= m_infoHeader.biBitCount;
                 }
             }
         } else {
             // RGB data.  Decode pixels one at a time, left to right.
             while (m_coord.x() < endX) {
                 const uint32_t pixel = readCurrentPixel(bytesPerPixel);
 
                 // Some BMPs specify an alpha channel but don't actually use it
@@ skipping 33 matching lines @@
     // Finished decoding whole image.
     return Success;
 }
 
 void BMPImageReader::moveBufferToNextRow()
 {
     m_coord.move(-m_coord.x(), m_isTopDown ? 1 : -1);
 }
 
 } // namespace WebCore