Bug 865919 - Check for still-negative heights when decoding BMPs. - r=joe

image/decoders/nsBMPDecoder.cpp

@@ -247,6 +247,12 @@ nsBMPDecoder::WriteInternal(const char* aBuffer, uint32_t aCount)
             return;
         }
 
+        // Check that our abs height is still valid.
+        if (GetHeight() < 0) {
+            PostDataError();
+            return;
+        }
+
         uint32_t real_height = GetHeight();
 
         // Post our size to the superclass