Add tests (and fix!) for known bad ICO files.

src/images/SkImageDecoder_libico.cpp

 /*
  * Copyright 2006 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkColorPriv.h"
 #include "SkImageDecoder.h"
 #include "SkStream.h"
@@ skipping 141 matching lines @@
     //otherwise, they could be used for error checking
     int w = readByte(buf, 6 + choice*16);
     int h = readByte(buf, 7 + choice*16);
     int colorCount = readByte(buf, 8 + choice*16);
     //int reservedToo = readByte(buf, 9 + choice*16);   //0
     //int planes = read2Bytes(buf, 10 + choice*16);       //1 - but often 0
     //int fakeBitCount = read2Bytes(buf, 12 + choice*16); //should be real - usually 0
     const size_t size = read4Bytes(buf, 14 + choice*16);           //matters?
     const size_t offset = read4Bytes(buf, 18 + choice*16);
     // promote the sum to 64-bits to avoid overflow
-    if (((uint64_t)offset + size) > length) {
+    if (offset > length || size > length || ((uint64_t)offset + size) > length) {
         return kFailure;
     }
 
     // Check to see if this is a PNG image inside the ICO
     {
         SkMemoryStream subStream(buf + offset, size, false);
         SkAutoTDelete<SkImageDecoder> otherDecoder(SkImageDecoder::Factory(&subStream));
         if (otherDecoder.get() != NULL) {
             // Disallow nesting ICO files within one another
             // FIXME: Can ICO files contain other formats besides PNG?
@@ skipping 251 matching lines @@
 static SkImageDecoder_DecodeReg gReg(sk_libico_dfactory);
 
 static SkImageDecoder::Format get_format_ico(SkStreamRewindable* stream) {
     if (is_ico(stream)) {
         return SkImageDecoder::kICO_Format;
     }
     return SkImageDecoder::kUnknown_Format;
 }
 
 static SkImageDecoder_FormatReg gFormatReg(get_format_ico);