Prevent malformed ICO files from recursively decoding

src/images/SkImageDecoder_libico.cpp

 /*
  * Copyright 2006 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkColorPriv.h"
 #include "SkImageDecoder.h"
 #include "SkStream.h"
@@ skipping 146 matching lines @@
     // promote the sum to 64-bits to avoid overflow
     if (((uint64_t)offset + size) > length) {
         return false;
     }
 
     // Check to see if this is a PNG image inside the ICO
     {
         SkMemoryStream subStream(buf + offset, size, false);
         SkAutoTDelete<SkImageDecoder> otherDecoder(SkImageDecoder::Factory(&subStream));
         if (otherDecoder.get() != NULL) {
+            // Disallow nesting ICO files within one another

[reed1, 2014/08/26 17:53:34]

Can we add a test case/data for this?

+            if (otherDecoder->getFormat() == SkImageDecoder::kICO_Format) {

[scroggo, 2014/10/14 22:58:23]

We could be more aggressive here; I think the only supported sub type is PNG.

+                return false;
+            }
             // Set fields on the other decoder to be the same as this one.
             this->copyFieldsToOther(otherDecoder.get());
             if(otherDecoder->decode(&subStream, bm, this->getDefaultPref(), mode)) {
                 return true;
             }
         }
     }
 
     //int infoSize = read4Bytes(buf, offset);             //40
     //int width = read4Bytes(buf, offset+4);              //should == w
@@ skipping 237 matching lines @@
 static SkImageDecoder_DecodeReg gReg(sk_libico_dfactory);
 
 static SkImageDecoder::Format get_format_ico(SkStreamRewindable* stream) {
     if (is_ico(stream)) {
         return SkImageDecoder::kICO_Format;
     }
     return SkImageDecoder::kUnknown_Format;
 }
 
 static SkImageDecoder_FormatReg gFormatReg(get_format_ico);