Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
BmpDecoder.prototype.bit4=function(){for(var g=Math.ceil(this.width/2),y=g%4,z=this.height-1;0<=z;z--){for(var B=0;B<g;B++){var m=this.buffer[this.pos++],h=z*this.width*4+8*B,c=m&15;m=this.palette[m>>4];this.data[h]=m.red;this.data[h+1]=m.green;this.data[h+2]=m.blue;this.data[h+3]=255;if(2*B+1>=this.width)break;m=this.palette[c];this.data[h+4]=m.red;this.data[h+4+1]=m.green;this.data[h+4+2]=m.blue;this.data[h+4+3]=255}0!=y&&(this.pos+=4-y)}};