wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 1240629. Don't buffer image file data that we are never going to look at in the gap between the header and the pixel data for BMP files. r=njn

Browse Source 
The length of the gap is computed from the BMP file header, so in a malformed BMP we could needlessly make our input file buffer huge for no reason.
This commit is contained in:
Timothy Nikkel 2016-02-12 16:58:34 -06:00
parent 2036ec54ac
commit 02307afbff
2 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
image/decoders/nsBMPDecoder.cpp
View File

@ -450,6 +450,7 @@ nsBMPDecoder::WriteInternal(const char* aBuffer, uint32_t aCount)
case State::BITFIELDS: return ReadBitfields(aData, aLength);
case State::COLOR_TABLE: return ReadColorTable(aData, aLength);
case State::GAP: return SkipGap();
case State::AFTER_GAP: return AfterGap();
case State::PIXEL_ROW: return ReadPixelRow(aData);
case State::RLE_SEGMENT: return ReadRLESegment(aData);
case State::RLE_DELTA: return ReadRLEDelta(aData);
@ -719,12 +720,19 @@ nsBMPDecoder::ReadColorTable(const char* aData, size_t aLength)
PostDataError();
return Transition::TerminateFailure();
}
uint32_t gapLength = mH.mDataOffset - mPreGapLength;
return Transition::To(State::GAP, gapLength);
return Transition::ToUnbuffered(State::AFTER_GAP, State::GAP, gapLength);
}
LexerTransition<nsBMPDecoder::State>
nsBMPDecoder::SkipGap()
{
return Transition::ContinueUnbuffered(State::GAP);
}
LexerTransition<nsBMPDecoder::State>
nsBMPDecoder::AfterGap()
{
// If there are no pixels we can stop.
//

2
image/decoders/nsBMPDecoder.h
View File

@ -165,6 +165,7 @@ private:
BITFIELDS,
COLOR_TABLE,
GAP,
AFTER_GAP,
PIXEL_ROW,
RLE_SEGMENT,
RLE_DELTA,
@ -194,6 +195,7 @@ private:
LexerTransition<State> ReadBitfields(const char* aData, size_t aLength);
LexerTransition<State> ReadColorTable(const char* aData, size_t aLength);
LexerTransition<State> SkipGap();
LexerTransition<State> AfterGap();
LexerTransition<State> ReadPixelRow(const char* aData);
LexerTransition<State> ReadRLESegment(const char* aData);
LexerTransition<State> ReadRLEDelta(const char* aData);