AK: Reject BitStream reads beyond EOF by default

The only exception to this is the lossless WebP decoder, which
legitimately relies on this behavior, even upstream.

AK/BitStream.h

@@ -156,7 +156,7 @@ public:
         FillWithZero,
     };
 
-    explicit LittleEndianInputBitStream(MaybeOwned<Stream> stream, UnsatisfiableReadBehavior unsatisfiable_read_behavior = UnsatisfiableReadBehavior::FillWithZero)
+    explicit LittleEndianInputBitStream(MaybeOwned<Stream> stream, UnsatisfiableReadBehavior unsatisfiable_read_behavior = UnsatisfiableReadBehavior::Reject)
         : LittleEndianBitStream(move(stream))
         , m_unsatisfiable_read_behavior(unsatisfiable_read_behavior)
     {

Userland/Libraries/LibGfx/ImageFormats/WebPLoaderLossless.cpp

@@ -26,7 +26,7 @@ ErrorOr<VP8LHeader> decode_webp_chunk_VP8L_header(ReadonlyBytes vp8l_data)
         return Error::from_string_literal("WebPImageDecoderPlugin: VP8L chunk too small");
 
     FixedMemoryStream memory_stream { vp8l_data.trim(5) };
-    LittleEndianInputBitStream bit_stream { MaybeOwned<Stream>(memory_stream) };
+    LittleEndianInputBitStream bit_stream { MaybeOwned<Stream>(memory_stream), LittleEndianInputBitStream::UnsatisfiableReadBehavior::FillWithZero };
 
     u8 signature = TRY(bit_stream.read_bits(8));
     if (signature != 0x2f)
@@ -931,7 +931,7 @@ ErrorOr<NonnullRefPtr<Bitmap>> ColorIndexingTransform::transform(NonnullRefPtr<B
 ErrorOr<NonnullRefPtr<Bitmap>> decode_webp_chunk_VP8L_contents(VP8LHeader const& vp8l_header)
 {
     FixedMemoryStream memory_stream { vp8l_header.lossless_data };
-    LittleEndianInputBitStream bit_stream { MaybeOwned<Stream>(memory_stream) };
+    LittleEndianInputBitStream bit_stream { MaybeOwned<Stream>(memory_stream), LittleEndianInputBitStream::UnsatisfiableReadBehavior::FillWithZero };
 
     // image-stream = optional-transform spatially-coded-image