Fix integer overflow (-INT_MIN) in blink::BMPImageReader::readInfoHeader

third_party/WebKit/Source/platform/image-decoders/bmp/BMPImageDecoderTest.cpp

Index: third_party/WebKit/Source/platform/image-decoders/bmp/BMPImageDecoderTest.cpp
diff --git a/third_party/WebKit/Source/platform/image-decoders/bmp/BMPImageDecoderTest.cpp b/third_party/WebKit/Source/platform/image-decoders/bmp/BMPImageDecoderTest.cpp
index 14b399a36edadf0050deb7f5a5abbbcfc8b620a7..0294d7beb7aa4548f6541d32b5ed75fce7dedf70 100644
--- a/third_party/WebKit/Source/platform/image-decoders/bmp/BMPImageDecoderTest.cpp
+++ b/third_party/WebKit/Source/platform/image-decoders/bmp/BMPImageDecoderTest.cpp
@@ -67,6 +67,59 @@ TEST(BMPImageDecoderTest, emptyImage)
     EXPECT_TRUE(decoder->failed());
 }
 
+TEST(BMPImageDecoderTest, negativeHeight)
+{
+    // Raw data for a BMP file with 1x1 white pixels and negative height.
+    const unsigned char whiteBMP[] = {

[Peter Kasting, 2016/08/19 08:42:51]

Why not just check these in as actual files in
LayoutTests/fast/images/resources/?

Also why do we need to run the whiteBMP test at all?  I'm not worried about
testing that a BMP with a negative height decodes correctly (as that's the
normal case and we already have test files that do that), and it's easier to
read a testcase that's focused on testing just one thing: the int32_min
handling.

[aleksandar.stojiljkovic, 2016/08/19 09:33:04]

No problem. I saw the approach used in DeferredImageDecoderTest and assumed it
is fine.
Done.

I'm testing 0x-1 because I didn't find a bmp with negative height in
LayoutTests/fast/images/resources/ neither I saw such test contributed to code
when bmp decoder was added. Probably there is a test for it, I just didn't find
it - if you know there is one, I will just remove the test. Thanks.

+        0x42, 0x4d, 0x7e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x7a, 0x00, 0x00, 0x00, 0x6c, 0x00, 0x00, 0x00, 0x01, 0x00,
+        0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x01, 0x00, 0x18, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x13, 0x0b,
+        0x00, 0x00, 0x13, 0x0b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x42, 0x47, 0x52, 0x73, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0xff, 0xff, 0xff, 0xa0,
+    };
+
+    // Raw data for an invalid BMP file with 1xINT32_MIN size.
+    const unsigned char whiteBMPWithInt32MinHeight[] = {
+        0x42, 0x4d, 0x7e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x7a, 0x00, 0x00, 0x00, 0x6c, 0x00, 0x00, 0x00, 0x01, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x01, 0x00, 0x18, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x13, 0x0b,
+        0x00, 0x00, 0x13, 0x0b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x42, 0x47, 0x52, 0x73, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0xff, 0xff, 0xff, 0xa0,
+    };
+
+    // Test when not all data is received.
+    RefPtr<SharedBuffer> data = SharedBuffer::create(whiteBMP, sizeof(whiteBMP) - 1);
+    std::unique_ptr<ImageDecoder> decoder = createDecoder();
+    decoder->setData(data.get(), false);
+    EXPECT_TRUE(decoder->isSizeAvailable());
+    EXPECT_EQ(1, decoder->size().width());
+    EXPECT_EQ(1, decoder->size().height());
+    EXPECT_FALSE(decoder->failed());
+
+    // Test if INT32_MIN causes error.
+    data = SharedBuffer::create(whiteBMPWithInt32MinHeight, sizeof(whiteBMPWithInt32MinHeight) - 1);
+    decoder = createDecoder();
+    decoder->setData(data.get(), false);
+    EXPECT_FALSE(decoder->isSizeAvailable());
+    EXPECT_TRUE(decoder->failed());
+}
+
 // This test verifies that calling SharedBuffer::mergeSegmentsIntoBuffer() does
 // not break BMP decoding at a critical point: in between a call to decode the
 // size (when BMPImageDecoder stops while it may still have input data to