Prevent crash in ICO caused by bad/truncated PNG

third_party/WebKit/Source/platform/image-decoders/ico/ICOImageDecoderTest.cpp

Index: third_party/WebKit/Source/platform/image-decoders/ico/ICOImageDecoderTest.cpp
diff --git a/third_party/WebKit/Source/platform/image-decoders/ico/ICOImageDecoderTest.cpp b/third_party/WebKit/Source/platform/image-decoders/ico/ICOImageDecoderTest.cpp
index d0314edd8dd6c39093a942acebb183b9552f1978..ee02e3133d214bee944b9d1b4757a391c26e2e2b 100644
--- a/third_party/WebKit/Source/platform/image-decoders/ico/ICOImageDecoderTest.cpp
+++ b/third_party/WebKit/Source/platform/image-decoders/ico/ICOImageDecoderTest.cpp
@@ -21,8 +21,39 @@ std::unique_ptr<ImageDecoder> createDecoder() {
 }
 }
 
+TEST(ICOImageDecoderTests, errorInPngInIco) {
+  RefPtr<SharedBuffer> data =
+      readFile("/LayoutTests/images/resources/png-in-ico.ico");
+  ASSERT_FALSE(data->isEmpty());
+
+  // Modify the file to have a broken CRC in IHDR.
+  constexpr size_t crcOffset = 22 + 29;
+  constexpr size_t crcSize = 4;
+  RefPtr<SharedBuffer> modifiedData =
+      SharedBuffer::create(data->data(), crcOffset);
+  Vector<char> badCrc(crcSize, 0);
+  modifiedData->append(badCrc);
+  modifiedData->append(data->data() + crcOffset + crcSize,
+                       data->size() - crcOffset - crcSize);
+
+  auto decoder = createDecoder();
+  decoder->setData(modifiedData.get(), true);
+
+  // ICOImageDecoder reports the frame count based on whether enough data has
+  // been received according to the icon directory. So even though the
+  // embedded PNG is broken, there is enough data to include it in the frame
+  // count.
+  EXPECT_EQ(1u, decoder->frameCount());
+
+  decoder->frameBufferAtIndex(0);
+  EXPECT_TRUE(decoder->failed());
+}
+
 TEST(ICOImageDecoderTests, parseAndDecodeByteByByte) {
   testByteByByteDecode(&createDecoder,
+                       "/LayoutTests/images/resources/png-in-ico.ico", 1u,
+                       cAnimationNone);
+  testByteByByteDecode(&createDecoder,
                        "/LayoutTests/images/resources/2entries.ico", 2u,
                        cAnimationNone);
   testByteByByteDecode(&createDecoder,