Don't read random data in ICO check.

src/images/SkImageDecoder_libico.cpp

 /*
  * Copyright 2006 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkColorPriv.h"
 #include "SkImageDecoder.h"
 #include "SkStream.h"
@@ skipping 384 matching lines @@
     alphaBit = 0;
 #endif
     int alpha = readByte(buf, xorOffset + 4*pixelNo + 3) & ((alphaBit-1)&0xFF);
     *address = SkPreMultiplyARGB(alpha, red, green, blue);
 }
 
 ///////////////////////////////////////////////////////////////////////////////
 DEFINE_DECODER_CREATOR(ICOImageDecoder);
 /////////////////////////////////////////////////////////////////////////////////////////
 
 static bool is_ico(SkStreamRewindable* stream) {

[mtklein, 2014/10/24 01:59:06]

Guh..

I know this is really secondary, but this code is a bit of an ugly duckling.

is_ico(...) {
  char buf[4];
  if (stream_read(buf, 4) != 4) {
    return false;
  }
  int reserve = read2Bytes(buf, 0),
      type    = read2Bytes(buf, 2);
  return reserved == 0 && type == 1;
}

     // Check to see if the first four bytes are 0,0,1,0
     // FIXME: Is that required and sufficient?
     SkAutoMalloc autoMal(4);
     unsigned char* buf = (unsigned char*)autoMal.get();
-    stream->read((void*)buf, 4);
+    if (stream->read((void*)buf, 4) < 4) {
+        return false;
+    }
     int reserved = read2Bytes(buf, 0);
     int type = read2Bytes(buf, 2);
     if (reserved != 0 || type != 1) {
         // This stream does not represent an ICO image.
         return false;
     }
     return true;
 }
 
 static SkImageDecoder* sk_libico_dfactory(SkStreamRewindable* stream) {
     if (is_ico(stream)) {
         return SkNEW(SkICOImageDecoder);
     }
     return NULL;
 }
 
 static SkImageDecoder_DecodeReg gReg(sk_libico_dfactory);
 
 static SkImageDecoder::Format get_format_ico(SkStreamRewindable* stream) {
     if (is_ico(stream)) {
         return SkImageDecoder::kICO_Format;
     }
     return SkImageDecoder::kUnknown_Format;
 }
 
 static SkImageDecoder_FormatReg gFormatReg(get_format_ico);