Fix integer overflow (-INT_MIN) in blink::BMPImageReader::readInfoHeader

third_party/WebKit/Source/platform/image-decoders/bmp/BMPImageReader.cpp

 /*
  * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 289 matching lines @@
     // during processBitmasks().
     if (isWindowsV4Plus()) {
         m_bitMasks[0] = readUint32(40);
         m_bitMasks[1] = readUint32(44);
         m_bitMasks[2] = readUint32(48);
         m_bitMasks[3] = readUint32(52);
     }
 
     // Detect top-down BMPs.
     if (m_infoHeader.biHeight < 0) {
+        // We can't negate INT32_MIN below to get a positive int32_t.
+        // isInfoHeaderValid() will reject heights of 1 << 16 or larger anyway,
+        // so just reject this bitmap now.
+        if (m_infoHeader.biHeight == INT32_MIN)
+            return m_parent->setFailed();
         m_isTopDown = true;
         m_infoHeader.biHeight = -m_infoHeader.biHeight;
     }
 
     return true;
 }
 
 bool BMPImageReader::isInfoHeaderValid() const
 {
     // Non-positive widths/heights are invalid.  (We've already flipped the
@@ skipping 492 matching lines @@
     // Finished decoding whole image.
     return Success;
 }
 
 void BMPImageReader::moveBufferToNextRow()
 {
     m_coord.move(-m_coord.x(), m_isTopDown ? 1 : -1);
 }
 
 } // namespace blink