From 24aa0012c2811f1bb3d9faaae011f51d3e8af53d Mon Sep 17 00:00:00 2001
From: "dveditz%cruzio.com"
 <dveditz%cruzio.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Fri, 27 Aug 2004 10:34:14 +0000
Subject: [PATCH] bug 255067 reduce max image size to prevent DOS

git-svn-id: svn://10.0.0.236/branches/AVIARY_1_0_20040515_BRANCH@161378 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/gfx/src/shared/gfxImageFrame.cpp              | 7 +++++++
 mozilla/gfx/src/windows/nsImageWin.cpp                | 4 ++++
 mozilla/modules/libpr0n/decoders/bmp/nsBMPDecoder.cpp | 4 +++-
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/mozilla/gfx/src/shared/gfxImageFrame.cpp b/mozilla/gfx/src/shared/gfxImageFrame.cpp
index 1bd4ba6606e..315870b0c0e 100644
--- a/mozilla/gfx/src/shared/gfxImageFrame.cpp
+++ b/mozilla/gfx/src/shared/gfxImageFrame.cpp
@@ -72,6 +72,13 @@ NS_IMETHODIMP gfxImageFrame::Init(nscoord aX, nscoord aY, nscoord aWidth, nscoor
     return NS_ERROR_FAILURE;
   }
 
+  /* reject over-wide or over-tall images */
+  const PRInt32 k64KLimit = 0x0000FFFF;
+  if ( aWidth > k64KLimit || aHeight > k64KLimit ){
+    NS_ERROR("image too big");
+    return NS_ERROR_FAILURE;
+  }
+
   nsresult rv;
 
   mOffset.MoveTo(aX, aY);
diff --git a/mozilla/gfx/src/windows/nsImageWin.cpp b/mozilla/gfx/src/windows/nsImageWin.cpp
index 4d1c8767ae9..abf73f09740 100644
--- a/mozilla/gfx/src/windows/nsImageWin.cpp
+++ b/mozilla/gfx/src/windows/nsImageWin.cpp
@@ -131,6 +131,10 @@ nsresult nsImageWin :: Init(PRInt32 aWidth, PRInt32 aHeight, PRInt32 aDepth,nsMa
     return NS_ERROR_UNEXPECTED;
   }
 
+  // limit images to 64k pixels on a side (~55 feet on a 100dpi monitor)
+  const PRInt32 k64KLimit = 0x0000FFFF;
+  if (aWidth > k64KLimit || aHeight > k64KLimit)
+      return NS_ERROR_FAILURE;
 
   if (mNumPaletteColors >= 0){
     // If we have a palette
diff --git a/mozilla/modules/libpr0n/decoders/bmp/nsBMPDecoder.cpp b/mozilla/modules/libpr0n/decoders/bmp/nsBMPDecoder.cpp
index 77897d041a0..e552f570aa7 100644
--- a/mozilla/modules/libpr0n/decoders/bmp/nsBMPDecoder.cpp
+++ b/mozilla/modules/libpr0n/decoders/bmp/nsBMPDecoder.cpp
@@ -274,7 +274,9 @@ NS_METHOD nsBMPDecoder::ProcessData(const char* aBuffer, PRUint32 aCount)
             CalcBitShift();
         }
         // BMPs with negative width are invalid
-        if (mBIH.width < 0)
+        // Reject extremely wide images to keep the math sane
+        const PRInt32 k64KWidth = 0x0000FFFF;
+        if (mBIH.width < 0 || mBIH.width > k64KWidth)
             return NS_ERROR_FAILURE;
 
         PRUint32 real_height = (mBIH.height > 0) ? mBIH.height : -mBIH.height;