Fix integer overflow (-INT_MIN) in blink::BMPImageReader::readInfoHeader

third_party/WebKit/Source/platform/image-decoders/bmp/BMPImageReader.cpp

Index: third_party/WebKit/Source/platform/image-decoders/bmp/BMPImageReader.cpp
diff --git a/third_party/WebKit/Source/platform/image-decoders/bmp/BMPImageReader.cpp b/third_party/WebKit/Source/platform/image-decoders/bmp/BMPImageReader.cpp
index 0ee27a6cd0630716f58445f3d3dfc4242a98b676..3fb77d66b4022ec27d03ccb071c588a71504f653 100644
--- a/third_party/WebKit/Source/platform/image-decoders/bmp/BMPImageReader.cpp
+++ b/third_party/WebKit/Source/platform/image-decoders/bmp/BMPImageReader.cpp
@@ -307,6 +307,8 @@ bool BMPImageReader::readInfoHeader()
 
     // Detect top-down BMPs.
     if (m_infoHeader.biHeight < 0) {
+        if (m_infoHeader.biHeight == INT32_MIN)

[Peter Kasting, 2016/08/17 22:21:24]

Nit: I think this deserves a comment, e.g.:

We can't negate INT32_MIN below to get a positive int32_t.  isInfoHeaderValid()
will reject heights of 1 << 16 or larger anyway, so just reject this bitmap now.

[aleksandar.stojiljkovic, 2016/08/18 21:31:00]

Done.

+            return false;

[Peter Kasting, 2016/08/17 22:21:24]

You need to return m_parent->setFailed() here, not just false.

[aleksandar.stojiljkovic, 2016/08/18 21:31:00]

Done.
Thanks. Although the returned false gets propagated to
BMPImageDecoder::decode(bool onlySize), setFailed() is called there only for
fully received files so it should be done as you suggested.

         m_isTopDown = true;
         m_infoHeader.biHeight = -m_infoHeader.biHeight;
     }