func: NS_METHOD CVE_2008_0420_PATCHED_nsBMPDecoder::ProcessData(const char* aBuffer, PRUint32 aCount) if ( ! aCount || ! mCurLine )  if ( mPos < BFH_LENGTH )  PRUint32 toCopy = BFH_LENGTH - mPos ; if ( toCopy > aCount )  toCopy = aCount; memcpy ( mRawBuf + mPos , aBuffer , toCopy ); mPos += toCopy; aCount -= toCopy; aBuffer += toCopy; if ( mPos == BFH_LENGTH )  if ( mBFH . signature [ 0 ] != 'B' || mBFH . signature [ 1 ] != 'M' )  if ( mBFH . bihsize == OS2_BIH_LENGTH )  mLOH = OS2_HEADER_LENGTH; if ( mPos >= BFH_LENGTH && mPos < mLOH )  PRUint32 toCopy = mLOH - mPos ; if ( toCopy > aCount )  toCopy = aCount; memcpy ( mRawBuf + ( mPos - BFH_LENGTH ) , aBuffer , toCopy ); memcpy ( mRawBuf + ( mPos - WIN_HEADER_LENGTH ) , aBuffer , toCopy ); mBitFields . red = LITTLE_TO_NATIVE32 ( * ( PRUint32 * ) mRawBuf ); mBitFields . green = LITTLE_TO_NATIVE32 ( * ( PRUint32 * ) ( mRawBuf + 4 ) ); mBitFields . blue = LITTLE_TO_NATIVE32 ( * ( PRUint32 * ) ( mRawBuf + 8 ) ); SetPixel ( d , ( val & mBitFields . red ) >> mBitFields . redRightShift << mBitFields . redLeftShift , ( val & mBitFields . green ) >> mBitFields . greenRightShift << mBitFields . greenLeftShift , ( val & mBitFields . blue ) >> mBitFields . blueRightShift << mBitFields . blueLeftShift ); 