Prevent crash in ICO caused by bad/truncated PNG
Make ICOImageDecoder::decodeAtIndex() check for a null return value
from frameBufferAtIndex before attempting to dereference it. Prior to
adding APNG support, PNGImageDecoder::frameBufferAtIndex would never
return null, since the method only returns null if the index is out of
range, and PNGImageDecoder used to always report a frameCount of 1. Now
it can return null, if the start of the first frame has not been parsed
yet, so ICOImageDecoder needs to check for that.
Remove the unnecessary line to setPremultiplyAlpha on the ImageFrame. It
is already set on the PNGImageDecoder, which already set it on the
ImageFrame.
Add an ICO with an embedded PNG, constructed from border-image.png,
which is already used by LayoutTests. The image directory in the ICO
has an error: it reports that the PNG is 29 bytes, rather than the
actual 480 bytes. ICOImageDecoder ignores such an error, but as a
result it will call decodeAtIndex before the PNGImageDecoder knows that
it has any valid frames. Without the fix, this image would crash during
partial decode.
Add two tests for ways this bug could be triggered:
- byte by byte decoding
- an ICO with a broken PNG file embedded inside
BUG=702293
Review-Url: https://codereview.chromium.org/2754003008
Cr-Commit-Position: refs/heads/master@{#458468}
3 files changed
