Stop supporting kUnknown_BmpHeaderType

In SkBmpCodec, if the header size does not match a known header,
stop trying to create an SkCodec. We do not know of any BMPs with
arbitrarily sized headers, so this should not cause any real

In addition, this fixes a bug where we attempt to read too much data
from a file. Since we attempt to read the header size in one read,
and a size reported by the "BMP" may be larger than SSIZE_MAX, this
will crash when reading from a file.

Add a test.


Change-Id: I0f3292db3124dc5ac5cbdbc07196bda130a49ba7
Commit-Queue: Leon Scroggins <>
Reviewed-by: Matt Sarett <>
(cherry picked from commit 0b24cbd9db8b894fdabce7a27f5369b320bee7f1)
diff --git a/tests/CodecTest.cpp b/tests/CodecTest.cpp
index 4a9c4a6..fb07774 100644
--- a/tests/CodecTest.cpp
+++ b/tests/CodecTest.cpp
@@ -1496,6 +1496,21 @@
     test_info(r, codec.get(), codec->getInfo(), SkCodec::kIncompleteInput, nullptr);
+DEF_TEST(Codec_InvalidBmp2, r) {
+    // This file reports a header size that crashes when we try to read this
+    // much directly from a file using SkFILEStream.
+    SkString path = GetResourcePath("invalid_images/b33651913.bmp");
+    SkAutoTDelete<SkFILEStream> stream(new SkFILEStream(path.c_str()));
+    if (!stream->isValid()) {
+        ERRORF(r, "no stream");
+        return;
+    }
+    SkAutoTDelete<SkCodec> codec(SkCodec::NewFromStream(stream.release()));
+    // This file is invalid, but more importantly, we did not crash before
+    // reaching here.
+    REPORTER_ASSERT(r, !codec);
 DEF_TEST(Codec_InvalidAnimated, r) {
     // ASAN will complain if there is an issue.
     auto path = "invalid_images/skbug6046.gif";