commit 0a7552ffa04bfb0c0523bd9c88e55e82842f53a8
author dsinclair <dsinclair@chromium.org> Tue Aug 02 12:36:07 2016 -0700
committer Commit bot <commit-bot@chromium.org> Tue Aug 02 12:36:07 2016 -0700
tree 8616cd4ce984a28c97c292eca7a079e626faefbd
parent b2e63373054f0f1c3dbcdfa5e75acf2831b113f6

Verify row bytes before alloc in BMP codec.

If the out_row_bytes is negative the alloc will fail. Verify the size before
alloc and bail if it's negative.

BUG=633381

Review-Url: https://codereview.chromium.org/2202283003

core/fxcodec/lbmp/fx_bmp.cpp

diff --git a/core/fxcodec/lbmp/fx_bmp.cpp b/core/fxcodec/lbmp/fx_bmp.cpp
index dcf1ee1..b7f2066 100644
--- a/core/fxcodec/lbmp/fx_bmp.cpp
+++ b/core/fxcodec/lbmp/fx_bmp.cpp
@@ -213,6 +213,12 @@
         break;
     }
     FX_Free(bmp_ptr->out_row_buffer);
+
+    if (bmp_ptr->out_row_bytes <= 0) {
+      bmp_error(bmp_ptr, "The Bmp File Is Corrupt");
+      return 0;
+    }
+
     bmp_ptr->out_row_buffer = FX_Alloc(uint8_t, bmp_ptr->out_row_bytes);
     FXSYS_memset(bmp_ptr->out_row_buffer, 0, bmp_ptr->out_row_bytes);
     bmp_save_decoding_status(bmp_ptr, BMP_D_STATUS_PAL);