Fix integer overflow (-INT_MIN) in blink::BMPImageReader::readInfoHeader

third_party/WebKit/Source/platform/image-decoders/bmp/BMPImageDecoderTest.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "platform/image-decoders/bmp/BMPImageDecoder.h"
 
 #include "platform/SharedBuffer.h"
 #include "platform/image-decoders/ImageDecoderTestHelpers.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/PtrUtil.h"
@@ skipping 49 matching lines @@
 
     std::unique_ptr<ImageDecoder> decoder = createDecoder();
     decoder->setData(data.get(), true);
 
     ImageFrame* frame = decoder->frameBufferAtIndex(0);
     ASSERT_TRUE(frame);
     EXPECT_EQ(ImageFrame::FrameEmpty, frame->getStatus());
     EXPECT_TRUE(decoder->failed());
 }
 
+TEST(BMPImageDecoderTest, negativeHeight)
+{
+    // Raw data for a BMP file with 1x1 white pixels and negative height.
+    const unsigned char whiteBMP[] = {

[Peter Kasting, 2016/08/19 08:42:51]

Why not just check these in as actual files in
LayoutTests/fast/images/resources/?

Also why do we need to run the whiteBMP test at all?  I'm not worried about
testing that a BMP with a negative height decodes correctly (as that's the
normal case and we already have test files that do that), and it's easier to
read a testcase that's focused on testing just one thing: the int32_min
handling.

[aleksandar.stojiljkovic, 2016/08/19 09:33:04]

No problem. I saw the approach used in DeferredImageDecoderTest and assumed it
is fine.
Done.

I'm testing 0x-1 because I didn't find a bmp with negative height in
LayoutTests/fast/images/resources/ neither I saw such test contributed to code
when bmp decoder was added. Probably there is a test for it, I just didn't find
it - if you know there is one, I will just remove the test. Thanks.

+        0x42, 0x4d, 0x7e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x7a, 0x00, 0x00, 0x00, 0x6c, 0x00, 0x00, 0x00, 0x01, 0x00,
+        0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x01, 0x00, 0x18, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x13, 0x0b,
+        0x00, 0x00, 0x13, 0x0b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x42, 0x47, 0x52, 0x73, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0xff, 0xff, 0xff, 0xa0,
+    };
+
+    // Raw data for an invalid BMP file with 1xINT32_MIN size.
+    const unsigned char whiteBMPWithInt32MinHeight[] = {
+        0x42, 0x4d, 0x7e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x7a, 0x00, 0x00, 0x00, 0x6c, 0x00, 0x00, 0x00, 0x01, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x01, 0x00, 0x18, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x13, 0x0b,
+        0x00, 0x00, 0x13, 0x0b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x42, 0x47, 0x52, 0x73, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0xff, 0xff, 0xff, 0xa0,
+    };
+
+    // Test when not all data is received.
+    RefPtr<SharedBuffer> data = SharedBuffer::create(whiteBMP, sizeof(whiteBMP) - 1);
+    std::unique_ptr<ImageDecoder> decoder = createDecoder();
+    decoder->setData(data.get(), false);
+    EXPECT_TRUE(decoder->isSizeAvailable());
+    EXPECT_EQ(1, decoder->size().width());
+    EXPECT_EQ(1, decoder->size().height());
+    EXPECT_FALSE(decoder->failed());
+
+    // Test if INT32_MIN causes error.
+    data = SharedBuffer::create(whiteBMPWithInt32MinHeight, sizeof(whiteBMPWithInt32MinHeight) - 1);
+    decoder = createDecoder();
+    decoder->setData(data.get(), false);
+    EXPECT_FALSE(decoder->isSizeAvailable());
+    EXPECT_TRUE(decoder->failed());
+}
+
 // This test verifies that calling SharedBuffer::mergeSegmentsIntoBuffer() does
 // not break BMP decoding at a critical point: in between a call to decode the
 // size (when BMPImageDecoder stops while it may still have input data to
 // read) and a call to do a full decode.
 TEST(BMPImageDecoderTest, mergeBuffer)
 {
     const char* bmpFile = "/LayoutTests/fast/images/resources/lenna.bmp";
     testMergeBuffer(&createDecoder, bmpFile);
 }
 
 } // namespace blink