Fix integer overflow (-INT_MIN) in blink::BMPImageReader::readInfoHeader

third_party/WebKit/Source/platform/image-decoders/bmp/BMPImageReader.cpp

 /*
  * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 289 matching lines @@
     // during processBitmasks().
     if (isWindowsV4Plus()) {
         m_bitMasks[0] = readUint32(40);
         m_bitMasks[1] = readUint32(44);
         m_bitMasks[2] = readUint32(48);
         m_bitMasks[3] = readUint32(52);
     }
 
     // Detect top-down BMPs.
     if (m_infoHeader.biHeight < 0) {
+        if (m_infoHeader.biHeight == INT32_MIN)

[Peter Kasting, 2016/08/17 22:21:24]

Nit: I think this deserves a comment, e.g.:

We can't negate INT32_MIN below to get a positive int32_t.  isInfoHeaderValid()
will reject heights of 1 << 16 or larger anyway, so just reject this bitmap now.

[aleksandar.stojiljkovic, 2016/08/18 21:31:00]

Done.

+            return false;

[Peter Kasting, 2016/08/17 22:21:24]

You need to return m_parent->setFailed() here, not just false.

[aleksandar.stojiljkovic, 2016/08/18 21:31:00]

Done.
Thanks. Although the returned false gets propagated to
BMPImageDecoder::decode(bool onlySize), setFailed() is called there only for
fully received files so it should be done as you suggested.

         m_isTopDown = true;
         m_infoHeader.biHeight = -m_infoHeader.biHeight;
     }
 
     return true;
 }
 
 bool BMPImageReader::isInfoHeaderValid() const
 {
     // Non-positive widths/heights are invalid.  (We've already flipped the
@@ skipping 492 matching lines @@
     // Finished decoding whole image.
     return Success;
 }
 
 void BMPImageReader::moveBufferToNextRow()
 {
     m_coord.move(-m_coord.x(), m_isTopDown ? 1 : -1);
 }
 
 } // namespace blink