Don't decode AND mask for an icon that already has alpha information

Source/platform/image-decoders/ico/ICOImageDecoder.cpp

Index: Source/platform/image-decoders/ico/ICOImageDecoder.cpp
diff --git a/Source/platform/image-decoders/ico/ICOImageDecoder.cpp b/Source/platform/image-decoders/ico/ICOImageDecoder.cpp
index 06dce8e51035e6f192292e52224884faebbab5c7..43113425d43a1f6fece66ba4d86b908d704f0279 100644
--- a/Source/platform/image-decoders/ico/ICOImageDecoder.cpp
+++ b/Source/platform/image-decoders/ico/ICOImageDecoder.cpp
@@ -216,8 +216,9 @@ bool ICOImageDecoder::decodeAtIndex(size_t index)
             // We need to have already sized m_frameBufferCache before this, and
             // we must not resize it again later (see caution in frameCount()).
             ASSERT(m_frameBufferCache.size() == m_dirEntries.size());
-            m_bmpReaders[index] = adoptPtr(new BMPImageReader(this, dirEntry.m_imageOffset, 0, true));
-            m_bmpReaders[index]->setData(m_data.get());
+            RefPtr<SharedBuffer> bmpData(SharedBuffer::create(&m_data->data()[dirEntry.m_imageOffset], dirEntry.m_imageSize));
+            m_bmpReaders[index] = adoptPtr(new BMPImageReader(this, 0, 0, true));
+            m_bmpReaders[index]->setData(bmpData.get());
             m_bmpReaders[index]->setBuffer(&m_frameBufferCache[index]);
         }
         m_frameSize = dirEntry.m_size;
@@ -314,8 +315,12 @@ ICOImageDecoder::IconDirectoryEntry ICOImageDecoder::readDirectoryEntry()
         entry.m_bitCount = readUint16(6);
         entry.m_hotSpot = IntPoint();
     }
+    entry.m_imageSize = readUint32(8);
     entry.m_imageOffset = readUint32(12);
 
+    // Make sure the image data doesn't go beyond the end of the file.
+    entry.m_imageSize = std::min(entry.m_imageSize, m_data->size() - entry.m_imageOffset);

[Peter Kasting, 2014/11/17 20:59:32]

It's not safe to clamp to m_data->size() here; the remaining file data may not
have streamed in by this point.

+
     // Some icons don't have a bit depth, only a color count.  Convert the
     // color count to the minimum necessary bit depth.  It doesn't matter if
     // this isn't quite what the bitmap info header says later, as we only use