Code: PassRefPtr<SharedBuffer> readFile(const char* fileName)
 {
     String filePath = Platform::current()->unitTestSupport()->webKitRootDir();
     filePath.append(fileName);
 
     return Platform::current()->unitTestSupport()->readFromFile(filePath);
}

Vulnerability Type: DoS 
CWE ID: 
Summary: Use-after-free vulnerability in the GIFImageReader::parseData function in platform/image-decoders/gif/GIFImageReader.cpp in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted frame size in a GIF image.
Commit Message: Fix handling of broken GIFs with weird frame sizes

Code didn't handle well if a GIF frame has dimension greater than the
"screen" dimension. This will break deferred image decoding.

This change reports the size as final only when the first frame is
encountered.

Added a test to verify this behavior. Frame size reported by the decoder
should be constant.

BUG=437651
R=pkasting@chromium.org, senorblanco@chromium.org

Review URL: https://codereview.chromium.org/813943003

git-svn-id: svn://svn.chromium.org/blink/trunk@188423 bbb929c8-8fbe-4397-9dbb-9b2b20218538