ICO: Skip checking declared entry bounds when file is completelly received.

third_party/WebKit/Source/platform/image-decoders/ico/ICOImageDecoder.cpp

 /*
  * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 113 matching lines @@
 
 size_t ICOImageDecoder::decodeFrameCount() {
   decodeSize();
 
   // If decodeSize() fails, return the existing number of frames.  This way
   // if we get halfway through the image before decoding fails, we won't
   // suddenly start reporting that the image has zero frames.
   if (failed())
     return m_frameBufferCache.size();
 
-  // Length of sequence of completely received frames.
-  for (size_t i = 0; i < m_dirEntries.size(); ++i) {
-    const IconDirectoryEntry& dirEntry = m_dirEntries[i];
-    if ((dirEntry.m_imageOffset + dirEntry.m_byteSize) > m_data->size())
-      return i;
+  // If the file is incomplete, return the length of the sequence of completely
+  // received frames.  We don't do this when the file is fully received, since
+  // some ICOs have entries whose claimed offset + size extends past the end of
+  // the file, and we still want to display these if they don't trigger decoding
+  // failures elsewhere.
+  if (!isAllDataReceived()) {
+    for (size_t i = 0; i < m_dirEntries.size(); ++i) {
+      const IconDirectoryEntry& dirEntry = m_dirEntries[i];
+      if ((dirEntry.m_imageOffset + dirEntry.m_byteSize) > m_data->size())
+        return i;
+    }
   }
   return m_dirEntries.size();
 }
 
 void ICOImageDecoder::setDataForPNGDecoderAtIndex(size_t index) {
   if (!m_pngDecoders[index])
     return;
 
   m_pngDecoders[index]->setData(m_data.get(), isAllDataReceived());
 }
@@ skipping 178 matching lines @@
   ASSERT_WITH_SECURITY_IMPLICATION(index < m_dirEntries.size());
   const uint32_t imageOffset = m_dirEntries[index].m_imageOffset;
   if ((imageOffset > m_data->size()) || ((m_data->size() - imageOffset) < 4))
     return Unknown;
   char buffer[4];
   const char* data = m_fastReader.getConsecutiveData(imageOffset, 4, buffer);
   return strncmp(data, "\x89PNG", 4) ? BMP : PNG;
 }
 
 }  // namespace blink