Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
BmpDecoder.prototype.bit8=function(){for(var h=this.width%4,y=this.height-1;0<=y;y--){for(var A=0;A<this.width;A++){var B=this.buffer[this.pos++],m=y*this.width*4+4*A;B<this.palette.length?(B=this.palette[B],this.data[m]=B.red,this.data[m+1]=B.green,this.data[m+2]=B.blue):(this.data[m]=255,this.data[m+1]=255,this.data[m+2]=255);this.data[m+3]=255}0!=h&&(this.pos+=4-h)}};