func: NS_METHOD CVE_2008_0420_PATCHED_nsBMPDecoder::ProcessData(const char* aBuffer, PRUint32 aCount) if ( ! aCount || ! mCurLine )  if ( mPos < BFH_LENGTH )  PRUint32 toCopy = BFH_LENGTH - mPos ; if ( toCopy > aCount )  toCopy = aCount; mPos += toCopy; aCount -= toCopy; aBuffer += toCopy; if ( mPos == BFH_LENGTH )  if ( mBFH . signature [ 0 ] != 'B' || mBFH . signature [ 1 ] != 'M' )  if ( mBFH . bihsize == OS2_BIH_LENGTH )  mLOH = OS2_HEADER_LENGTH; if ( mPos >= BFH_LENGTH && mPos < mLOH )  PRUint32 toCopy = mLOH - mPos ; if ( toCopy > aCount )  toCopy = aCount; mPos += toCopy; aCount -= toCopy; aBuffer += toCopy; if ( mPos == mLOH )  if ( mBIH . bpp != 1 && mBIH . bpp != 4 && mBIH . bpp != 8 && mBIH . bpp != 16 && mBIH . bpp != 24 && mBIH . bpp != 32 )  if ( mBIH . bpp <= 8 )  mNumColors = 1 << mBIH . bpp; if ( mBIH . colors && mBIH . colors < mNumColors )  mNumColors = mBIH . colors; mColors = new colorTable [ 256 ]; if ( ! mColors )  memset ( mColors , 0 , 256 * sizeof ( colorTable ) ); if ( mBIH . width < 0 )  PRUint32 real_height = ( mBIH . height > 0 ) ? mBIH . height : - mBIH . height ; mCurLine = real_height; mRow = new PRUint8 [ ( mBIH . width * mBIH . bpp ) / 8 + 4 ]; if ( ! mRow )  PRUint8 bpc ; bpc = ( mBFH . bihsize == OS2_BIH_LENGTH ) ? 3 : 4; if ( mColors && ( mPos >= mLOH && ( mPos < ( mLOH + mNumColors * bpc ) ) ) )  while ( aCount && ( mPos < ( mLOH + mNumColors * bpc ) ) )  mPos ++; aBuffer ++; aCount --; if ( aCount && mBIH . compression == BI_BITFIELDS && mPos < ( WIN_HEADER_LENGTH + BITFIELD_LENGTH ) )  PRUint32 toCopy = ( WIN_HEADER_LENGTH + BITFIELD_LENGTH ) - mPos ; if ( toCopy > aCount )  toCopy = aCount; mPos += toCopy; aBuffer += toCopy; aCount -= toCopy; while ( aCount && ( mPos < mBFH . dataoffset ) )  mPos ++; aBuffer ++; aCount --; if ( aCount && ++ mPos >= mBFH . dataoffset )  if ( ! mBIH . compression || mBIH . compression == BI_BITFIELDS )  if ( ( mBIH . compression == BI_RLE8 ) || ( mBIH . compression == BI_RLE4 ) )  if ( ( ( mBIH . compression == BI_RLE8 ) && ( mBIH . bpp != 8 ) ) || ( ( mBIH . compression == BI_RLE4 ) && ( mBIH . bpp != 4 ) && ( mBIH . bpp != 1 ) ) )  if ( ! mAlpha )  PRUint32 alpha ; mAlpha = ( PRUint8 * ) calloc ( alpha , 8 ); if ( ! mAlpha )  mAlphaPtr = mAlpha; if ( ! mDecoded )  mDecoded = ( PRUint8 * ) calloc ( mBpr , 1 ); if ( ! mDecoded )  while ( aCount > 0 )  PRUint8 byte ; switch ( mState )  mStateData = ( PRUint8 ) * aBuffer ++; aCount --; mState = eRLEStateNeedSecondEscapeByte; byte = * aBuffer ++; aCount --; if ( mStateData != RLE_ESCAPE )  if ( mAlphaPtr + mStateData > mAlpha + mBIH . width )  mStateData = ( PRUint32 ) ( mAlpha + mBIH . width - mAlphaPtr ); memset ( mAlphaPtr , 0xFF , mStateData ); mAlphaPtr += mStateData; if ( mBIH . compression == BI_RLE8 )  while ( mStateData > 0 )  mStateData --; while ( mStateData > 0 )  Set4BitPixel ( mDecoding , byte , mStateData , mColors ); mState = eRLEStateInitial; switch ( byte )  mAlphaPtr = mAlpha; mState = eRLEStateInitial; mState = eRLEStateNeedXDelta; mStateData = byte; if ( mAlphaPtr + mStateData > mAlpha + mBIH . width )  mStateData -= mBIH . width & 1; if ( mAlphaPtr + mStateData > mAlpha + mBIH . width )  memset ( mAlphaPtr , 0xFF , mStateData ); mAlphaPtr += mStateData; if ( ( ( mStateData - 1 ) & mBIH . compression ) != 0 )  mState = eRLEStateAbsoluteMode; mState = eRLEStateAbsoluteModePadded; byte = * aBuffer ++; aCount --; mAlphaPtr += byte; if ( mAlphaPtr > mAlpha + mBIH . width )  mAlphaPtr = mAlpha + mBIH . width; mState = eRLEStateNeedYDelta; byte = * aBuffer ++; aCount --; mState = eRLEStateInitial; if ( byte == 0 )  if ( mBIH . compression == BI_RLE8 )  while ( aCount > 0 && mStateData > 0 )  byte = * aBuffer ++; aCount --; mStateData --; while ( aCount > 0 && mStateData > 0 )  byte = * aBuffer ++; aCount --; Set4BitPixel ( mDecoding , byte , mStateData , mColors ); if ( mStateData == 0 )  if ( mState == eRLEStateAbsoluteMode )  mState = eRLEStateInitial; if ( aCount > 0 )  aBuffer ++; aCount --; mState = eRLEStateInitial; if ( mCurLine == 0 )  