func: NS_METHOD CVE_2008_0420_VULN_nsBMPDecoder::ProcessData(const char* aBuffer, PRUint32 aCount) if ( ! aCount || ! mCurLine )  if ( mPos < BFH_LENGTH )  PRUint32 toCopy = BFH_LENGTH - mPos ; if ( toCopy > aCount )  toCopy = aCount; mPos += toCopy; aCount -= toCopy; aBuffer += toCopy; if ( mPos == BFH_LENGTH )  if ( mBFH . signature [ 0 ] != 'B' || mBFH . signature [ 1 ] != 'M' )  if ( mBFH . bihsize == OS2_BIH_LENGTH )  mLOH = OS2_HEADER_LENGTH; if ( mPos >= BFH_LENGTH && mPos < mLOH )  PRUint32 toCopy = mLOH - mPos ; if ( toCopy > aCount )  toCopy = aCount; mPos += toCopy; aCount -= toCopy; aBuffer += toCopy; if ( mPos == mLOH )  if ( mBIH . bpp != 1 && mBIH . bpp != 4 && mBIH . bpp != 8 && mBIH . bpp != 16 && mBIH . bpp != 24 && mBIH . bpp != 32 )  if ( mBIH . bpp <= 8 )  mNumColors = 1 << mBIH . bpp; if ( mBIH . colors && mBIH . colors < mNumColors )  mNumColors = mBIH . colors; mColors = new colorTable [ mNumColors ]; if ( ! mColors )  if ( mBIH . width < 0 )  PRUint32 real_height = ( mBIH . height > 0 ) ? mBIH . height : - mBIH . height ; mCurLine = real_height; mRow = new PRUint8 [ ( mBIH . width * mBIH . bpp ) / 8 + 4 ]; if ( ! mRow )  PRUint8 bpc ; bpc = ( mBFH . bihsize == OS2_BIH_LENGTH ) ? 3 : 4; if ( mColors && ( mPos >= mLOH && ( mPos < ( mLOH + mNumColors * bpc ) ) ) )  while ( aCount && ( mPos < ( mLOH + mNumColors * bpc ) ) )  mPos ++; aBuffer ++; aCount --; if ( aCount && mBIH . compression == BI_BITFIELDS && mPos < ( WIN_HEADER_LENGTH + BITFIELD_LENGTH ) )  PRUint32 toCopy = ( WIN_HEADER_LENGTH + BITFIELD_LENGTH ) - mPos ; if ( toCopy > aCount )  toCopy = aCount; mPos += toCopy; aBuffer += toCopy; aCount -= toCopy; while ( aCount && ( mPos < mBFH . dataoffset ) )  mPos ++; aBuffer ++; aCount --; if ( aCount && ++ mPos >= mBFH . dataoffset )  if ( ! mBIH . compression || mBIH . compression == BI_BITFIELDS )  PRUint32 rowSize = ( mBIH . bpp * mBIH . width + 7 ) / 8 ; if ( rowSize % 4 )  rowSize += ( 4 - ( rowSize % 4 ) ); PRUint32 toCopy ; toCopy = rowSize - mRowBytes; if ( toCopy )  if ( toCopy > aCount )  toCopy = aCount; memcpy ( mRow + mRowBytes , aBuffer , toCopy ); aCount -= toCopy; aBuffer += toCopy; mRowBytes += toCopy; if ( ( rowSize - mRowBytes ) == 0 )  if ( ! mDecoded )  mDecoded = ( PRUint8 * ) malloc ( mBpr ); if ( ! mDecoded )  if ( mCurLine == 0 )  mRowBytes = 0; while ( aCount > 0 )  