Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
BmpDecoder.prototype.bit4=function(){for(var h=Math.ceil(this.width/2),y=h%4,A=this.height-1;0<=A;A--){for(var B=0;B<h;B++){var m=this.buffer[this.pos++],g=A*this.width*4+8*B,b=m&15;m=this.palette[m>>4];this.data[g]=m.red;this.data[g+1]=m.green;this.data[g+2]=m.blue;this.data[g+3]=255;if(2*B+1>=this.width)break;m=this.palette[b];this.data[g+4]=m.red;this.data[g+4+1]=m.green;this.data[g+4+2]=m.blue;this.data[g+4+3]=255}0!=y&&(this.pos+=4-y)}};