From fb64b3367fa7e2c68213c94606a9c96037991850 Mon Sep 17 00:00:00 2001 From: James Jackson-South Date: Sat, 6 Apr 2024 12:44:45 +1000 Subject: [PATCH] Clamp read palette indices. --- src/ImageSharp/Formats/Png/PngScanlineProcessor.cs | 3 ++- tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.cs | 8 ++++++++ tests/ImageSharp.Tests/TestImages.cs | 2 ++ tests/Images/Input/Png/issues/Issue_2714.png | 3 +++ 4 files changed, 15 insertions(+), 1 deletion(-) create mode 100644 tests/Images/Input/Png/issues/Issue_2714.png diff --git a/src/ImageSharp/Formats/Png/PngScanlineProcessor.cs b/src/ImageSharp/Formats/Png/PngScanlineProcessor.cs index b327ed21ba..c653e71c62 100644 --- a/src/ImageSharp/Formats/Png/PngScanlineProcessor.cs +++ b/src/ImageSharp/Formats/Png/PngScanlineProcessor.cs @@ -199,11 +199,12 @@ public static void ProcessInterlacedPaletteScanline( ref TPixel rowSpanRef = ref MemoryMarshal.GetReference(rowSpan); ref Color paletteBase = ref MemoryMarshal.GetReference(palette.Value.Span); uint offset = pixelOffset + frameControl.XOffset; + int maxIndex = palette.Value.Length - 1; for (nuint x = offset, o = 0; x < frameControl.XMax; x += increment, o++) { uint index = Unsafe.Add(ref scanlineSpanRef, o); - pixel.FromRgba32(Unsafe.Add(ref paletteBase, index).ToRgba32()); + pixel.FromRgba32(Unsafe.Add(ref paletteBase, (int)Math.Min(index, maxIndex)).ToRgba32()); Unsafe.Add(ref rowSpanRef, x) = pixel; } } diff --git a/tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.cs b/tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.cs index 9ff368d4ec..8d4bc3f461 100644 --- a/tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.cs +++ b/tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.cs @@ -693,4 +693,12 @@ public void Info_BadZTXT(string file) string path = Path.GetFullPath(Path.Combine(TestEnvironment.InputImagesDirectoryFullPath, file)); _ = Image.Identify(path); } + + [Theory] + [InlineData(TestImages.Png.Bad.Issue2714BadPalette)] + public void Decode_BadPalette(string file) + { + string path = Path.GetFullPath(Path.Combine(TestEnvironment.InputImagesDirectoryFullPath, file)); + using Image image = Image.Load(path); + } } diff --git a/tests/ImageSharp.Tests/TestImages.cs b/tests/ImageSharp.Tests/TestImages.cs index afb13363d4..f925f1a90b 100644 --- a/tests/ImageSharp.Tests/TestImages.cs +++ b/tests/ImageSharp.Tests/TestImages.cs @@ -192,6 +192,8 @@ public static class Bad public const string BadZTXT = "Png/issues/bad-ztxt.png"; public const string BadZTXT2 = "Png/issues/bad-ztxt2.png"; + + public const string Issue2714BadPalette = "Png/issues/Issue_2714.png"; } } diff --git a/tests/Images/Input/Png/issues/Issue_2714.png b/tests/Images/Input/Png/issues/Issue_2714.png new file mode 100644 index 0000000000..9bb231dd9f --- /dev/null +++ b/tests/Images/Input/Png/issues/Issue_2714.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:9a4b6efc3090dbd70ae9efe97ea817464845263536beea4e80fd7c884dee6c5a +size 128