Bug 865919 - Abort decode of INT32_MIN BMPs. r=joe

This commit is contained in:
Jeff Gilbert 2013-07-30 17:49:41 -07:00
parent e8b8439a32
commit 5d6b5329a8

View File

@ -247,6 +247,11 @@ nsBMPDecoder::WriteInternal(const char* aBuffer, uint32_t aCount)
return;
}
if (mBIH.height == INT_MIN) {
PostDataError();
return;
}
uint32_t real_height = GetHeight();
// Post our size to the superclass