Join GitHub today
image/png: crash in readImagePass #11604
From a Camlistore bug report perkeep/perkeep#631 (not go-fuzz for once), this image crashes image/png:
The file's contents:
Ah, the "Average filter" code has a special case for the first column in each row, and normally, the image width must be positive, but for an interlaced image, http://www.w3.org/TR/PNG/#8Interlace says "NOTE If the reference image contains fewer than five columns or fewer than five rows, some passes will be empty", and the special case code doesn't handle a zero width sub-sample and panics.
The fix should be easy, but we're deep into the 1.5 release freeze, so I'll punt until 1.6.
(Note to myself: check also that the PNG decoder rejects a 0-width image, regardless of interlacing. http://www.w3.org/TR/PNG/#11IHDR says that "Zero is an invalid value" but decoder.parseIHDR looks like it accepts zeroes.)