diff --git a/image/decoders/nsICODecoder.cpp b/image/decoders/nsICODecoder.cpp
--- a/image/decoders/nsICODecoder.cpp
+++ b/image/decoders/nsICODecoder.cpp
@@ -132,16 +132,18 @@ bool nsICODecoder::FillBitmapFileHeaderB
 // this difference though.
 bool
 nsICODecoder::FixBitmapHeight(PRInt8 *bih) 
 {
   // Get the height from the BMP file information header
   PRInt32 height;
   memcpy(&height, bih + 8, sizeof(height));
   height = LITTLE_TO_NATIVE32(height);
+  // BMPs can be stored inverted by having a negative height
+  height = abs(height);
 
   // The bitmap height is by definition * 2 what it should be to account for
   // the 'AND mask'. It is * 2 even if the `AND mask` is not present.
   height /= 2;
 
   if (height > 256) {
     return false;
   }
