From 357de81606cf12e7738a117fb4a21d02f86d438c Mon Sep 17 00:00:00 2001
From: Nicholas Nethercote <nnethercote@mozilla.com>
Date: Sun, 15 Nov 2015 20:31:07 -0800
Subject: [PATCH] Bug 1217465 - Fill in missing pixels caused by truncated BMP
 files. r=seth.

This fixes failures for
image/test/reftest/bmp/bmpsuite/b/{badrle.bmp,shortfile.bmp} with the Skia
back-end.
---
 image/decoders/nsBMPDecoder.cpp | 11 +++++++++++
 image/decoders/nsBMPDecoder.h   |  5 +++--
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/image/decoders/nsBMPDecoder.cpp b/image/decoders/nsBMPDecoder.cpp
index f0639417695..877fb6e599b 100644
--- a/image/decoders/nsBMPDecoder.cpp
+++ b/image/decoders/nsBMPDecoder.cpp
@@ -240,6 +240,17 @@ nsBMPDecoder::FinishInternal()
   // Send notifications if appropriate.
   if (!IsMetadataDecode() && HasSize()) {
 
+    // If it was truncated, fill in the missing pixels as black.
+    while (mCurrentRow > 0) {
+      uint32_t* dst = RowBuffer();
+      while (mCurrentPos < mH.mWidth) {
+        SetPixel(dst, 0, 0, 0);
+        mCurrentPos++;
+      }
+      mCurrentPos = 0;
+      FinishRow();
+    }
+
     // Invalidate.
     nsIntRect r(0, 0, mH.mWidth, AbsoluteHeight());
     PostInvalidation(r);
diff --git a/image/decoders/nsBMPDecoder.h b/image/decoders/nsBMPDecoder.h
index 1a0d3af1c1b..bcb6937bff0 100644
--- a/image/decoders/nsBMPDecoder.h
+++ b/image/decoders/nsBMPDecoder.h
@@ -230,8 +230,9 @@ private:
 
   int32_t mCurrentRow;      // Index of the row of the image that's currently
                             // being decoded: [height,1].
-  int32_t mCurrentPos;      // Index into the current line; only used when
-                            // doing RLE decoding.
+  int32_t mCurrentPos;      // Index into the current line. Used when
+                            // doing RLE decoding and when filling in pixels
+                            // for truncated files.
 
   // Only used in RLE_ABSOLUTE state: the number of pixels to read.
   uint32_t mAbsoluteModeNumPixels;