Bug 865919 - Check for still-negative heights when decoding BMPs. - r=joe

This commit is contained in:
Jeff Gilbert 2013-07-01 17:32:06 -07:00
parent 32874625f1
commit 315d51e816

View File

@ -247,6 +247,12 @@ nsBMPDecoder::WriteInternal(const char* aBuffer, uint32_t aCount)
return;
}
// Check that our abs height is still valid.
if (GetHeight() < 0) {
PostDataError();
return;
}
uint32_t real_height = GetHeight();
// Post our size to the superclass