ICO: Skip checking declared entry bounds when file is completelly received.

third_party/WebKit/Source/platform/image-decoders/ico/ICOImageDecoder.cpp

 /*
  * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 113 matching lines @@
 
 size_t ICOImageDecoder::decodeFrameCount() {
   decodeSize();
 
   // If decodeSize() fails, return the existing number of frames.  This way
   // if we get halfway through the image before decoding fails, we won't
   // suddenly start reporting that the image has zero frames.
   if (failed())
     return m_frameBufferCache.size();
 
+  // Skip checking entries offset and byte size when file is fully received.
+  // See crbug.com/653075.

[Peter Kasting, 2016/10/05 19:03:27]

Nit: I'd like this comment to say more about why we're doing this rather than
kicking to an external bug, so it's clear to a reader (it wasn't clear to me
without looking around more).  How about refactoring like this:

  // If the file is incomplete, return the length of the sequence of completely
  // received frames.  We don't do this when the file is fully received, since
  // some ICOs have entries whose claimed offset + size extends past the end of
  // the file, and we still want to display these if they don't trigger decoding
  // failures elsewhere.
  if (!isAllDataReceived()) {
    for (size_t i = 0; i < m_dirEntries.size(); ++i) {
      const IconDirectoryEntry& dirEntry = m_dirEntries[i];
      if ((dirEntry.m_imageOffset + dirEntry.m_byteSize) > m_data->size())
        return i;
    }
  }

  return m_dirEntries.size();

+  if (isAllDataReceived())
+    return m_dirEntries.size();
+
   // Length of sequence of completely received frames.
   for (size_t i = 0; i < m_dirEntries.size(); ++i) {
     const IconDirectoryEntry& dirEntry = m_dirEntries[i];
     if ((dirEntry.m_imageOffset + dirEntry.m_byteSize) > m_data->size())
       return i;
   }
   return m_dirEntries.size();
 }
 
 void ICOImageDecoder::setDataForPNGDecoderAtIndex(size_t index) {
@@ skipping 183 matching lines @@
   ASSERT_WITH_SECURITY_IMPLICATION(index < m_dirEntries.size());
   const uint32_t imageOffset = m_dirEntries[index].m_imageOffset;
   if ((imageOffset > m_data->size()) || ((m_data->size() - imageOffset) < 4))
     return Unknown;
   char buffer[4];
   const char* data = m_fastReader.getConsecutiveData(imageOffset, 4, buffer);
   return strncmp(data, "\x89PNG", 4) ? BMP : PNG;
 }
 
 }  // namespace blink