BitmapImage crashes when loading a PNG with embedded colour profile and using a display virtual colour profile

[MarkIngramUK]

• .NET Core Version: N/A (.NET Framework)
• Windows version: 10.0.19041 (20H1) and 10.0.19042 (20H2)
• Does the bug reproduce also in WPF for .NET Framework 4.8?: Unknown, using 4.7.2.
• Is this bug related specifically to tooling in Visual Studio (e.g. XAML Designer, Code editing, etc...)? No

Problem description:
After customers have updated their OS to 20H1 or 20H2 some have had their System Default display colour profile changed to "sRGB virtual device model profile". When loading a PNG with the iCCP ancillary chunk as a System.Windows.Media.Imaging.BitmapImage from a stream, it will now crash. If the customer changes the colour profile back to "sRGB IEC61966-2.1" the crash no longer occurs (or if we load a PNG without the iCCP chunk, that won't crash either).

Actual behavior:
Stack trace from our app:

Framework version: v4.0.30319
Description: The process terminated due to an unhandled exception.
Exception information: System.ArithmeticException

Exception information: System.OverflowException
    at System.Windows.Media.Imaging.ColorConvertedBitmap.FinalizeCreation ()
    at System.Windows.Media.Imaging.BitmapImage.FinalizeCreation ()
    at System.Windows.Media.Imaging.BitmapImage.EndInit ()
    ...

Expected behavior:
Doesn't crash.

Minimal repro:

Ensure that your System Default colour profile is "sRGB virtual device model profile" (setting it for the user won't generate the crash, it has to be the System Default).

I've attached a complete repo, including a PNG with embedded colour profile, but this is the source:
ColourProfileCrash.zip

using System.Reflection;
using System.Windows.Media.Imaging;

namespace ColourProfileCrash
{
    class Program
    {
        static void Main(string[] args)
        {
            var assembly = Assembly.GetExecutingAssembly();
            var names = assembly.GetManifestResourceNames();
            var stream = assembly.GetManifestResourceStream(names[0]);

            var image = new BitmapImage();
            image.BeginInit();
            image.StreamSource = stream;
            //image.CreateOptions = BitmapCreateOptions.IgnoreColorProfile;
            image.EndInit();
        }
    }
}

Exception message (OverflowException):

The image data generated an overflow during processing.

Inner exception message (ArithmeticException):

Overflow or underflow in the arithmetic operation.

Or solution has been to catch the exception, and try the load again, but ignoring the colour profile.

BitmapImage image;
try
{
	image = new BitmapImage();
	image.BeginInit();
	image.StreamSource = stream;
	image.EndInit();
}
catch(Exception)
{
	image = new BitmapImage();
	image.BeginInit();
	image.StreamSource = stream;
	image.CreateOptions = BitmapCreateOptions.IgnoreColorProfile;
	image.EndInit();
}

Some customer reports of the issue:
https://forum.affinity.serif.com/index.php?/topic/121111-affinity-photo-and-designer-wont-launch-anymore/&do=findComment&comment=662948
https://forum.affinity.serif.com/index.php?/topic/127975-win10-install-shows-in-system-tray-then-disappears/&do=findComment&comment=702680
https://forum.affinity.serif.com/index.php?/topic/121274-the-colors-are-totally-wrong-in-affinity/&do=findComment&comment=661865
https://forum.affinity.serif.com/index.php?/topic/126311-designer-publisher-and-photo-did-not-start-after-win10-update-to-20h2/
https://forum.affinity.serif.com/index.php?/topic/124081-cant-reinstall-after-no-start-problem/&do=findComment&comment=682029
https://forum.affinity.serif.com/index.php?/topic/118653-photo-crash-on-startup-even-installer-windows/&do=findComment&comment=645262

[martinivanoff]

This exception reproduces also in the ImageSourceConverter used with the TypeConverter of the ImageSource class. In other words, the error is thrown if you use a string path for the image source in XAML.

<Image Source="/WpfApp1;component/Images/myimage.png"/>

In that case the stacktrace originates from the TypeConverterMarkupExtension class:

> System.ArithmeticException: Overflow or underflow in the arithmetic operation.
   --- End of inner exception stack trace ---
   at System.Windows.Media.Imaging.ColorConvertedBitmap.FinalizeCreation()
   at System.Windows.Media.Imaging.ColorConvertedBitmap..ctor(BitmapSource source, ColorContext sourceColorContext, ColorContext destinationColorContext, PixelFormat format)
   at System.Windows.Media.Imaging.BitmapSource.CreateCachedBitmap(BitmapFrame frame, BitmapSourceSafeMILHandle wicSource, BitmapCreateOptions createOptions, BitmapCacheOption cacheOption, BitmapPalette palette)
   at System.Windows.Media.Imaging.BitmapFrameDecode.FinalizeCreation()
   at System.Windows.Media.Imaging.BitmapFrameDecode..ctor(Int32 frameNumber, BitmapCreateOptions createOptions, BitmapCacheOption cacheOption, BitmapDecoder decoder)
   at System.Windows.Media.Imaging.BitmapDecoder.SetupFrames(BitmapDecoder decoder, ReadOnlyCollection`1 frames)
   at System.Windows.Media.Imaging.BitmapDecoder.get_Frames()
   at System.Windows.Media.Imaging.BitmapFrame.CreateFromUriOrStream(Uri baseUri, Uri uri, Stream stream, BitmapCreateOptions createOptions, BitmapCacheOption cacheOption, RequestCachePolicy uriCachePolicy)
   at System.Windows.Media.ImageSourceConverter.ConvertFrom(ITypeDescriptorContext context, CultureInfo culture, Object value)
   at System.Windows.Baml2006.TypeConverterMarkupExtension.ProvideValue(IServiceProvider serviceProvider)
....................

[miloush]

This no longer reproduces in 8.0.100-preview.3.23178.7 (OS 25357.1).

@martinivanoff if you have a new repro please post it, otherwise this can be closed as fixed (or external)

[ghost]

This submission has been automatically marked as stale because it has been marked as requiring author feedback but has not had any activity for 14 days.

It will be closed if no further activity occurs within 7 days of this comment.