Prevent crash in ICO caused by bad/truncated PNG

third_party/WebKit/Source/platform/image-decoders/ico/ICOImageDecoder.cpp

 /*
  * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 200 matching lines @@
   if (!m_pngDecoders[index]) {
     AlphaOption alphaOption =
         m_premultiplyAlpha ? AlphaPremultiplied : AlphaNotPremultiplied;
     m_pngDecoders[index] = WTF::wrapUnique(
         new PNGImageDecoder(alphaOption, m_colorBehavior, m_maxDecodedBytes,
                             dirEntry.m_imageOffset));
     setDataForPNGDecoderAtIndex(index);
   }
   // Fail if the size the PNGImageDecoder calculated does not match the size
   // in the directory.
-  if (m_pngDecoders[index]->isSizeAvailable() &&
-      (m_pngDecoders[index]->size() != dirEntry.m_size))
+  auto* pngDecoder = m_pngDecoders[index].get();
+  if (pngDecoder->isSizeAvailable() && pngDecoder->size() != dirEntry.m_size)
     return setFailed();
-  m_frameBufferCache[index] = *m_pngDecoders[index]->frameBufferAtIndex(0);
-  m_frameBufferCache[index].setPremultiplyAlpha(m_premultiplyAlpha);
-  return !m_pngDecoders[index]->failed() || setFailed();
+  const auto* frame = pngDecoder->frameBufferAtIndex(0);
+  if (frame)
+    m_frameBufferCache[index] = *frame;
+  return !pngDecoder->failed() || setFailed();
 }
 
 bool ICOImageDecoder::processDirectory() {
   // Read directory.
   DCHECK(!m_decodedOffset);
   if (m_data->size() < sizeOfDirectory)
     return false;
   const uint16_t fileType = readUint16(2);
   m_dirEntriesCount = readUint16(4);
   m_decodedOffset = sizeOfDirectory;
@@ skipping 88 matching lines @@
   SECURITY_DCHECK(index < m_dirEntries.size());
   const uint32_t imageOffset = m_dirEntries[index].m_imageOffset;
   if ((imageOffset > m_data->size()) || ((m_data->size() - imageOffset) < 4))
     return Unknown;
   char buffer[4];
   const char* data = m_fastReader.getConsecutiveData(imageOffset, 4, buffer);
   return strncmp(data, "\x89PNG", 4) ? BMP : PNG;
 }
 
 }  // namespace blink