From e0b0c340f27be57a183197ca68f368d07c5586b3 Mon Sep 17 00:00:00 2001
From: "asqueella%gmail.com"
 <asqueella%gmail.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Sun, 2 Sep 2007 16:10:57 +0000
Subject: [PATCH] Bug 391667 - imglib does not gracefully handle unknown images
 sent with incorrect MIME types p=Ben Karel <web+moz@eschew.org> r+a=pavlov

git-svn-id: svn://10.0.0.236/trunk@233741 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/modules/libpr0n/src/imgRequest.cpp | 21 ++++++++++++++++++++-
 mozilla/modules/libpr0n/src/imgRequest.h   |  4 ++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/mozilla/modules/libpr0n/src/imgRequest.cpp b/mozilla/modules/libpr0n/src/imgRequest.cpp
index 51e2f44b661..c492deef8e1 100644
--- a/mozilla/modules/libpr0n/src/imgRequest.cpp
+++ b/mozilla/modules/libpr0n/src/imgRequest.cpp
@@ -78,7 +78,8 @@ NS_IMPL_ISUPPORTS6(imgRequest, imgILoad,
 imgRequest::imgRequest() : 
   mLoading(PR_FALSE), mProcessing(PR_FALSE), mHadLastPart(PR_FALSE),
   mNetworkStatus(0), mImageStatus(imgIRequest::STATUS_NONE), mState(0),
-  mCacheId(0), mValidator(nsnull), mIsMultiPartChannel(PR_FALSE)
+  mCacheId(0), mValidator(nsnull), mIsMultiPartChannel(PR_FALSE),
+  mImageSniffers("image-sniffing-services") 
 {
   /* member initializers and constructor code */
 }
@@ -928,6 +929,24 @@ void
 imgRequest::SniffMimeType(const char *buf, PRUint32 len)
 {
   imgLoader::GetMimeTypeFromContent(buf, len, mContentType);
+
+  // The vast majority of the time, imgLoader will find a gif/jpeg/png image
+  // and fill mContentType with the sniffed MIME type.
+  if (!mContentType.IsEmpty())
+    return;
+
+  // When our sniffing fails, we want to query registered image decoders
+  // to see if they can identify the image. If we always trusted the server
+  // to send the right MIME, images sent as text/plain would not be rendered.
+  const nsCOMArray<nsIContentSniffer>& sniffers = mImageSniffers.GetEntries();
+  PRUint32 length = sniffers.Count();
+  for (PRUint32 i = 0; i < length; ++i) {
+    nsresult rv =
+      sniffers[i]->GetMIMETypeFromContent(nsnull, (const PRUint8 *) buf, len, mContentType);
+    if (NS_SUCCEEDED(rv) && !mContentType.IsEmpty()) {
+      return;
+    }
+  }
 }
 
 nsresult 
diff --git a/mozilla/modules/libpr0n/src/imgRequest.h b/mozilla/modules/libpr0n/src/imgRequest.h
index 08047333877..fd1e7fb4d8d 100644
--- a/mozilla/modules/libpr0n/src/imgRequest.h
+++ b/mozilla/modules/libpr0n/src/imgRequest.h
@@ -47,11 +47,13 @@
 #include "imgIDecoderObserver.h"
 
 #include "nsICacheEntryDescriptor.h"
+#include "nsIContentSniffer.h"
 #include "nsIRequest.h"
 #include "nsIProperties.h"
 #include "nsIStreamListener.h"
 #include "nsIURI.h"
 
+#include "nsCategoryCache.h"
 #include "nsCOMPtr.h"
 #include "nsString.h"
 #include "nsVoidArray.h"
@@ -173,6 +175,8 @@ private:
 
   imgCacheValidator *mValidator;
   PRBool   mIsMultiPartChannel;
+
+  nsCategoryCache<nsIContentSniffer> mImageSniffers;
 };
 
 #endif