func: NS_METHOD CVE_2008_0420_PATCHED_nsBMPDecoder::ProcessData(const char* aBuffer, PRUint32 aCount) if ( ! aCount || ! mCurLine )  if ( mPos < BFH_LENGTH )  PRUint32 toCopy = BFH_LENGTH - mPos ; if ( toCopy > aCount )  toCopy = aCount; memcpy ( mRawBuf + mPos , aBuffer , toCopy ); mPos += toCopy; aCount -= toCopy; aBuffer += toCopy; if ( mPos == BFH_LENGTH )  if ( mBFH . signature [ 0 ] != 'B' || mBFH . signature [ 1 ] != 'M' )  if ( mBFH . bihsize == OS2_BIH_LENGTH )  mLOH = OS2_HEADER_LENGTH; if ( mPos >= BFH_LENGTH && mPos < mLOH )  PRUint32 toCopy = mLOH - mPos ; if ( toCopy > aCount )  toCopy = aCount; memcpy ( mRawBuf + ( mPos - BFH_LENGTH ) , aBuffer , toCopy ); mPos += toCopy; aCount -= toCopy; aBuffer += toCopy; if ( mPos == mLOH )  if ( mBIH . bpp != 1 && mBIH . bpp != 4 && mBIH . bpp != 8 && mBIH . bpp != 16 && mBIH . bpp != 24 && mBIH . bpp != 32 )  if ( mBIH . bpp <= 8 )  mNumColors = 1 << mBIH . bpp; if ( mBIH . colors && mBIH . colors < mNumColors )  mNumColors = mBIH . colors; mColors = new colorTable [ 256 ]; if ( ! mColors )  memset ( mColors , 0 , 256 * sizeof ( colorTable ) ); if ( mBIH . width < 0 )  mRow = new PRUint8 [ ( mBIH . width * mBIH . bpp ) / 8 + 4 ]; if ( ! mRow )  PRUint8 bpc ; bpc = ( mBFH . bihsize == OS2_BIH_LENGTH ) ? 3 : 4; if ( mColors && ( mPos >= mLOH && ( mPos < ( mLOH + mNumColors * bpc ) ) ) )  if ( aCount && mBIH . compression == BI_BITFIELDS && mPos < ( WIN_HEADER_LENGTH + BITFIELD_LENGTH ) )  PRUint32 toCopy = ( WIN_HEADER_LENGTH + BITFIELD_LENGTH ) - mPos ; if ( toCopy > aCount )  toCopy = aCount; memcpy ( mRawBuf + ( mPos - WIN_HEADER_LENGTH ) , aBuffer , toCopy ); mBitFields . red = LITTLE_TO_NATIVE32 ( * ( PRUint32 * ) mRawBuf ); mBitFields . green = LITTLE_TO_NATIVE32 ( * ( PRUint32 * ) ( mRawBuf + 4 ) ); mBitFields . blue = LITTLE_TO_NATIVE32 ( * ( PRUint32 * ) ( mRawBuf + 8 ) ); SetPixel ( d , ( val & mBitFields . red ) >> mBitFields . redRightShift << mBitFields . redLeftShift , ( val & mBitFields . green ) >> mBitFields . greenRightShift << mBitFields . greenLeftShift , ( val & mBitFields . blue ) >> mBitFields . blueRightShift << mBitFields . blueLeftShift ); 