Stop supporting kUnknown_BmpHeaderType

In SkBmpCodec, if the header size does not match a known header,
stop trying to create an SkCodec. We do not know of any BMPs with
arbitrarily sized headers, so this should not cause any real
regressions.

In addition, this fixes a bug where we attempt to read too much data
from a file. Since we attempt to read the header size in one read,
and a size reported by the "BMP" may be larger than SSIZE_MAX, this
will crash when reading from a file.

Add a test.

BUG:b/33651913

Change-Id: I0f3292db3124dc5ac5cbdbc07196bda130a49ba7
Reviewed-on: https://skia-review.googlesource.com/6150
Commit-Queue: Leon Scroggins <scroggo@google.com>
Reviewed-by: Matt Sarett <msarett@google.com>

1 files changed, 16 insertions, 0 deletions

diff --git a/tests/CodecTest.cpp b/tests/CodecTest.cpp
index 05e8c3f4e8..05859a95b3 100644
--- a/tests/CodecTest.cpp
+++ b/tests/CodecTest.cpp
@@ -1453,6 +1453,22 @@ DEF_TEST(Codec_InvalidImages, r) {
     test_invalid_images(r, "invalid_images/many-progressive-scans.jpg", false);
 }
 
+DEF_TEST(Codec_InvalidBmp, r) {
+    // This file reports a header size that crashes when we try to read this
+    // much directly from a file using SkFILEStream.
+    SkString path = GetResourcePath("invalid_images/b33651913.bmp");
+    std::unique_ptr<SkFILEStream> stream(new SkFILEStream(path.c_str()));
+    if (!stream->isValid()) {
+        ERRORF(r, "no stream");
+        return;
+    }
+
+    std::unique_ptr<SkCodec> codec(SkCodec::NewFromStream(stream.release()));
+    // This file is invalid, but more importantly, we did not crash before
+    // reaching here.
+    REPORTER_ASSERT(r, !codec);
+}
+
 DEF_TEST(Codec_InvalidAnimated, r) {
     // ASAN will complain if there is an issue.
     auto path = "invalid_images/skbug6046.gif";