Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

image/png: decoding of trailing IDAT chunks #14936

Closed
tdilo opened this issue Mar 23, 2016 · 1 comment
Closed

image/png: decoding of trailing IDAT chunks #14936

tdilo opened this issue Mar 23, 2016 · 1 comment

Comments

@tdilo
Copy link
Contributor

@tdilo tdilo commented Mar 23, 2016

Decoding of some PNG files generated by GDAL2Tiles (raster map tile generator) fails with the error message "not enough pixel data". Most other decoders can read these files without any issues.

Even though the error message suggests otherwise, the problematic files actually contain too much data. Following the expected IDAT chunks containing all of the image data, there is an additional zero-length IDAT chunk.

According to the PNG specification, zero-length IDAT chunks are valid. Trailing garbage may not be valid, but the spec explicitly allows ignoring of errors that have no effect on the processing of the image.

The error message "not enough pixel data" is generated after the decoder successfully decodes the image: it then encounters the trailing zero-length IDAT chunk and attempts to decode it as if it were the first IDAT chunk in the image.

No error is generated when the decoder encounters trailing IDAT chunks that contain actual image data, as long as that image data can be decoded with the PNG header (and palette) already seen. This allows users to craft images that trick the decoder into decoding a second image appended after the first.

See the image below, which most decoders will show as plain white, while image/png will happily reveal the gopher hidden within:
hiddengopher

CL with proposed fix following.

@gopherbot
Copy link

@gopherbot gopherbot commented Mar 23, 2016

CL https://golang.org/cl/21045 mentions this issue.

@gopherbot gopherbot closed this in 633e414 Mar 24, 2016
@golang golang locked and limited conversation to collaborators Mar 24, 2017
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
2 participants
You can’t perform that action at this time.