-
Notifications
You must be signed in to change notification settings - Fork 17.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
image/png: crash in readImagePass #11604
Comments
Ah, the "Average filter" code has a special case for the first column in each row, and normally, the image width must be positive, but for an interlaced image, http://www.w3.org/TR/PNG/#8Interlace says "NOTE If the reference image contains fewer than five columns or fewer than five rows, some passes will be empty", and the special case code doesn't handle a zero width sub-sample and panics. The fix should be easy, but we're deep into the 1.5 release freeze, so I'll punt until 1.6. (Note to myself: check also that the PNG decoder rejects a 0-width image, regardless of interlacing. http://www.w3.org/TR/PNG/#11IHDR says that "Zero is an invalid value" but decoder.parseIHDR looks like it accepts zeroes.) |
Could you prepare a fix anyway? Camlistore will apply it in a fork of |
https://go-review.googlesource.com/12064 is a fix, waiting for the tree to open for Go 1.6. |
From a Camlistore bug report perkeep/perkeep#631 (not go-fuzz for once), this image crashes image/png:
https://cloud.githubusercontent.com/assets/597768/8498231/b8dd6142-21c7-11e5-91e1-f07b4bc5f474.png
The file's contents:
/cc @dvyukov
The text was updated successfully, but these errors were encountered: