Bug 775794. r=jgilbert. a=akeybl
authorBrian R. Bondy <netzen@gmail.com>
Sat, 21 Jul 2012 13:57:35 -0400
changeset 81921 bb1d806b2efa69a73dda642bdbc387fbe21653be
parent 81920 6fdfc850e249427a092030b7ec81a47773e668cc
child 81922 bd76cc13e6a8bdc83d17fd85953ff44a784162b9
push id219
push userbbondy@mozilla.com
push dateWed, 25 Jul 2012 02:32:50 +0000
reviewersjgilbert, akeybl
bugs775794
milestone10.0.7esrpre
Bug 775794. r=jgilbert. a=akeybl
image/decoders/nsICODecoder.cpp
--- a/image/decoders/nsICODecoder.cpp
+++ b/image/decoders/nsICODecoder.cpp
@@ -168,16 +168,18 @@ bool nsICODecoder::FillBitmapFileHeaderB
 // this difference though.
 bool
 nsICODecoder::FixBitmapHeight(PRInt8 *bih) 
 {
   // Get the height from the BMP file information header
   PRInt32 height;
   memcpy(&height, bih + 8, sizeof(height));
   height = LITTLE_TO_NATIVE32(height);
+  // BMPs can be stored inverted by having a negative height
+  height = abs(height);
 
   // The bitmap height is by definition * 2 what it should be to account for
   // the 'AND mask'. It is * 2 even if the `AND mask` is not present.
   height /= 2;
 
   if (height > 256) {
     return false;
   }