Chromium Code Reviews| Index: Source/platform/image-decoders/bmp/BMPImageReader.cpp |
| diff --git a/Source/platform/image-decoders/bmp/BMPImageReader.cpp b/Source/platform/image-decoders/bmp/BMPImageReader.cpp |
| index 32dc46d1baaf34f1750f1755dd30027909ab516f..4d010ffbcf7a971fda5dcb9b23293bf6f876ecaf 100644 |
| --- a/Source/platform/image-decoders/bmp/BMPImageReader.cpp |
| +++ b/Source/platform/image-decoders/bmp/BMPImageReader.cpp |
| @@ -95,8 +95,9 @@ bool BMPImageReader::decodeBMP(bool onlySize) |
| if (!m_infoHeader.biSize && !readInfoHeaderSize()) |
| return false; |
| + const size_t headerEnd = m_headerOffset + m_infoHeader.biSize; |
| // Read and process info header. |
| - if ((m_decodedOffset < (m_headerOffset + m_infoHeader.biSize)) && !processInfoHeader()) |
| + if ((m_decodedOffset < headerEnd) && !processInfoHeader()) |
| return false; |
| // processInfoHeader() set the size, so if that's all we needed, we're done. |
| @@ -175,7 +176,8 @@ bool BMPImageReader::readInfoHeaderSize() |
| // Don't allow the header to overflow (which would be harmless here, but |
| // problematic or at least confusing in other places), or to overrun the |
| // image data. |
| - if (((m_headerOffset + m_infoHeader.biSize) < m_headerOffset) || (m_imgDataOffset && (m_imgDataOffset < (m_headerOffset + m_infoHeader.biSize)))) |
| + const size_t headerEnd = m_headerOffset + m_infoHeader.biSize; |
| + if ((headerEnd < m_headerOffset) || (m_imgDataOffset && (m_imgDataOffset < headerEnd))) |
| return m_parent->setFailed(); |
| // See if this is a header size we understand: |
| @@ -422,18 +424,20 @@ bool BMPImageReader::processBitmasks() |
| // we read the info header. |
| // Fail if we don't have enough file space for the bitmasks. |
| - static const size_t SIZEOF_BITMASKS = 12; |
| - if (((m_headerOffset + m_infoHeader.biSize + SIZEOF_BITMASKS) < (m_headerOffset + m_infoHeader.biSize)) || (m_imgDataOffset && (m_imgDataOffset < (m_headerOffset + m_infoHeader.biSize + SIZEOF_BITMASKS)))) |
| + const size_t bitmasksSize = 12; |
|
Peter Kasting
2015/02/04 04:59:02
Tiny nit: Swap this line with the next
changseok
2015/02/04 05:34:46
Done.
|
| + const size_t headerEnd = m_headerOffset + m_infoHeader.biSize; |
| + const size_t bitmasksEnd = headerEnd + bitmasksSize; |
| + if ((bitmasksEnd < headerEnd) || (m_imgDataOffset && (m_imgDataOffset < bitmasksEnd))) |
| return m_parent->setFailed(); |
| // Read bitmasks. |
| - if ((m_data->size() - m_decodedOffset) < SIZEOF_BITMASKS) |
| + if ((m_data->size() - m_decodedOffset) < bitmasksSize) |
| return false; |
| m_bitMasks[0] = readUint32(0); |
| m_bitMasks[1] = readUint32(4); |
| m_bitMasks[2] = readUint32(8); |
| - m_decodedOffset += SIZEOF_BITMASKS; |
| + m_decodedOffset += bitmasksSize; |
| } |
| // Alpha is a poorly-documented and inconsistently-used feature. |
| @@ -529,10 +533,12 @@ bool BMPImageReader::processBitmasks() |
| bool BMPImageReader::processColorTable() |
| { |
| - size_t tableSizeInBytes = m_infoHeader.biClrUsed * (m_isOS21x ? 3 : 4); |
| + const size_t tableSizeInBytes = m_infoHeader.biClrUsed * (m_isOS21x ? 3 : 4); |
|
Peter Kasting
2015/02/04 04:59:01
Tiny nit: Swap this line with the next
changseok
2015/02/04 05:34:46
Done.
|
| + const size_t headerEnd = m_headerOffset + m_infoHeader.biSize; |
| + const size_t tableEnd = headerEnd + tableSizeInBytes; |
|
Peter Kasting
2015/02/04 04:59:01
Nit: Eliminate this newline and move the comment b
changseok
2015/02/04 05:34:46
Done.
|
| // Fail if we don't have enough file space for the color table. |
| - if (((m_headerOffset + m_infoHeader.biSize + tableSizeInBytes) < (m_headerOffset + m_infoHeader.biSize)) || (m_imgDataOffset && (m_imgDataOffset < (m_headerOffset + m_infoHeader.biSize + tableSizeInBytes)))) |
| + if ((tableEnd < headerEnd) || (m_imgDataOffset && (m_imgDataOffset < tableEnd))) |
| return m_parent->setFailed(); |
| // Read color table. |