x/image/bmp: makeslice: len out of range

[dvyukov]

Run the following program on the following input:

package main

import (
    "bytes"
    "io/ioutil"
    "os"
    "golang.org/x/image/bmp"
)

func main() {
    data, _ := ioutil.ReadFile(os.Args[1])
    img, err := bmp.Decode(bytes.NewReader(data))
    if err != nil {
        return
    }
    var w bytes.Buffer
    err = bmp.Encode(&w, img)
    if err != nil {
        panic(err)
    }
}

https://drive.google.com/file/d/0B20Uwp8Hs1oCc1dwYXJlMTRna0E/view?usp=sharing

It crashes as:

panic: runtime error: makeslice: len out of range

goroutine 1 [running]:
runtime.gopanic(0x4d6b40, 0xc20800e590)
    src/runtime/panic.go:477 +0x3fe fp=0xc208041c50 sp=0xc208041bd0
runtime.makeslice(0x4ac5a0, 0x3c00009f60, 0x3c00009f60, 0x0, 0x0, 0x0)
    src/runtime/slice.go:26 +0xce fp=0xc208041ca0 sp=0xc208041c50
golang.org/x/image/bmp.decodeRGB(0x7fe619a4d2d8, 0xc20800a480, 0x7fe619a4d0d0, 0xc20802e020, 0x400000aa, 0x3c, 0x0, 0x0, 0x0, 0x0, ...)
    src/golang.org/x/image/bmp/reader.go:57 +0x185 fp=0xc208041e30 sp=0xc208041ca0
golang.org/x/image/bmp.Decode(0x7fe619a4d2d8, 0xc20800a480, 0x0, 0x0, 0x0, 0x0)
    src/golang.org/x/image/bmp/reader.go:112 +0x15b fp=0xc208041ed0 sp=0xc208041e30
main.main()
    /tmp/bmp.go:12 +0x132 fp=0xc208041f90 sp=0xc208041ed0

I am on commit 65a798f031fd31a65574938bed2ec44c2bcba496

[chai2010]

Same as #10399, the bmp size is too large.

[rsc]

Not Go 1.5, unless you think this is a runtime bug. Subrepos are not in Go releases.

[nigeltao]

Yes, as chai2010 said, this is a duplicate of #10399.