fixing topcrash bug 89595. r=dougt sr=darin a=robert@ocallahan.org

modules/libpr0n/decoders/png/nsPNGDecoder.cpp

@@ -42,15 +42,13 @@ PR_STATIC_CALLBACK(void) end_callback(png_structp png_ptr, png_infop info_ptr);
 
 NS_IMPL_ISUPPORTS1(nsPNGDecoder, imgIDecoder)
 
-nsPNGDecoder::nsPNGDecoder()
+nsPNGDecoder::nsPNGDecoder() :
+  mPNG(nsnull), mInfo(nsnull),
+  colorLine(nsnull), alphaLine(nsnull),
+  interlacebuf(nsnull), ibpr(0),
+  mError(PR_FALSE)
 {
   NS_INIT_ISUPPORTS();
-
-  mPNG = nsnull;
-  mInfo = nsnull;
-  colorLine = 0;
-  alphaLine = 0;
-  interlacebuf = 0;
 }
 
 nsPNGDecoder::~nsPNGDecoder()
@@ -122,28 +120,44 @@ static NS_METHOD ReadDataOut(nsIInputStream* in,
 {
   nsPNGDecoder *decoder = NS_STATIC_CAST(nsPNGDecoder*, closure);
 
-  // we need to do the setjmp here otherwise bad things will happen
-  if (setjmp(decoder->mPNG->jmpbuf)) {
-    png_destroy_read_struct(&decoder->mPNG, &decoder->mInfo, NULL);
+  if (decoder->mError) {
     *writeCount = 0;
     return NS_ERROR_FAILURE;
   }
 
-  return decoder->ProcessData((unsigned char*)fromRawSegment, count, writeCount);
-}
+  // we need to do the setjmp here otherwise bad things will happen
+  if (setjmp(decoder->mPNG->jmpbuf)) {
+    png_destroy_read_struct(&decoder->mPNG, &decoder->mInfo, NULL);
 
-nsresult nsPNGDecoder::ProcessData(unsigned char *data, PRUint32 count, PRUint32 *readCount)
-{
-  png_process_data(mPNG, mInfo, data, count);
-  *readCount = count; // we always consume all the data
+    decoder->mError = PR_TRUE;
+    *writeCount = 0;
+    return NS_ERROR_FAILURE;
+  }
+
+  png_process_data(decoder->mPNG, decoder->mInfo,
+                   NS_REINTERPRET_CAST(unsigned char *, NS_CONST_CAST(char *, fromRawSegment)), count);
+
+  *writeCount = count;
   return NS_OK;
 }
 
+
 /* unsigned long writeFrom (in nsIInputStream inStr, in unsigned long count); */
 NS_IMETHODIMP nsPNGDecoder::WriteFrom(nsIInputStream *inStr, PRUint32 count, PRUint32 *_retval)
 {
   NS_ASSERTION(inStr, "Got a null input stream!");
-  return inStr->ReadSegments(ReadDataOut, this, count, _retval);
+
+  nsresult rv;
+
+  if (!mError)
+    rv = inStr->ReadSegments(ReadDataOut, this, count, _retval);
+
+  if (mError) {
+    *_retval = 0;
+    rv = NS_ERROR_FAILURE;
+  }
+
+  return rv;
 }
 
 

modules/libpr0n/decoders/png/nsPNGDecoder.h

@@ -53,8 +53,6 @@ public:
   nsPNGDecoder();
   virtual ~nsPNGDecoder();
 
-  inline nsresult ProcessData(unsigned char *data, PRUint32 count, PRUint32 *readCount);
-
 public:
   nsCOMPtr<imgIContainer> mImage;
   nsCOMPtr<gfxIImageFrame> mFrame;
@@ -66,6 +64,7 @@ public:
   PRUint8 *colorLine, *alphaLine;
   PRUint8 *interlacebuf;
   PRUint32 ibpr;
+  PRPackedBool mError;
 };
 
 #endif // nsPNGDecoder_h__

modules/libpr0n/decoders/png/nsPNGFactory.cpp

@@ -1,46 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
- *
- * The contents of this file are subject to the Mozilla Public
- * License Version 1.1 (the "License"); you may not use this file
- * except in compliance with the License. You may obtain a copy of
- * the License at http://www.mozilla.org/MPL/
- * 
- * Software distributed under the License is distributed on an "AS
- * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
- * implied. See the License for the specific language governing
- * rights and limitations under the License.
- * 
- * The Original Code is mozilla.org code.
- * 
- * The Initial Developer of the Original Code is Netscape
- * Communications Corporation. Portions created by Netscape are
- * Copyright (C) 2001 Netscape Communications Corporation. All
- * Rights Reserved.
- * 
- * Contributor(s): 
- *   Stuart Parmenter <pavlov@netscape.com>
- */
-
-#include "nsIGenericFactory.h"
-#include "nsIModule.h"
-
-#include "nsPNGDecoder.h"
-
-// objects that just require generic constructors
-
-NS_GENERIC_FACTORY_CONSTRUCTOR(nsPNGDecoder)
-
-static const nsModuleComponentInfo components[] =
-{
-  { "PNG decoder",
-    NS_PNGDECODER_CID,
-    "@mozilla.org/image/decoder;2?type=image/png",
-    nsPNGDecoderConstructor, },
-  { "PNG decoder",
-    NS_PNGDECODER_CID,
-    "@mozilla.org/image/decoder;2?type=image/x-png",
-    nsPNGDecoderConstructor, },
-};
-
-NS_IMPL_NSGETMODULE(nsPNGDecoderModule, components)
-