image/png: panic in Decode

[fishy]

Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (go version)?

1.8

What operating system and processor architecture are you using (go env)?

linux/amd64

What did you do?

Calling png.Decode panicked at image/png.(*decoder).readImagePass, here's the call stack:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x97f9c8]

goroutine 52345 [running]:
image/png.(*decoder).readImagePass(0xc423806400, 0x7f91a3f47ac8, 0xc42130b6d0, 0x0, 0xc42130b600, 0x0, 0x0, 0xc422d84000, 0xc423806478)
        /usr/local/go/src/image/png/reader.go:615 +0x1028
image/png.(*decoder).decode(0xc423806400, 0x0, 0x0, 0x0, 0x0)
        /usr/local/go/src/image/png/reader.go:365 +0x621
image/png.(*decoder).parseIDAT(0xc423806400, 0x4f, 0xfdb929, 0x4)
        /usr/local/go/src/image/png/reader.go:827 +0x36
image/png.(*decoder).parseChunk(0xc423806400, 0x0, 0x0)
        /usr/local/go/src/image/png/reader.go:887 +0x45a
image/png.Decode(0x1783fe0, 0xc42675ef30, 0xfdad15, 0x1, 0xc42316f740, 0x2)
        /usr/local/go/src/image/png/reader.go:946 +0x161
(caller deducted)

Looking at image/png/reader.go:615, I think it might be because of gray was nil. gray was only initialized before on line 438, in the case of !d.useTransparent, so when d.useTransparent == true and it's the cbG8 case, it might panic. (I'm no PNG expert so I'm not sure whether that's a case that's not supposed to happen)

What did you expect to see?

What did you see instead?

[bradfitz]

Can you share the source file?

[fishy]

This is the hex values of the []byte (with bytes.NewReader, of course) I passed to png.Decode:

89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0f 00 00 00 0b 08 00 00 00 00 85 2c 88 80 00 00 00 02 74 52 4e 53 00 ff 5b 91 22 b5 00 00 00 02 62 4b 47 44 00 ff 87 8f cc bf 00 00 00 09 70 48 59 73 00 00 0a f0 00 00 0a f0 01 42 ac 34 98 00 00 00 07 74 49 4d 45 07 d5 04 02 12 11 11 f7 65 3d 8b 00 00 00 4f 49 44 41 54 08 d7 63 f8 ff ff ff b9 bd 70 f0 8c 01 c8 af 6e 99 02 05 d9 7b c1 fc 6b ff a1 a0 87 30 ff d9 de bd d5 4b f7 ee fd 0e e3 ef cd 06 19 14 f5 1e ce ef 01 31 92 d7 82 41 31 9c 3f 07 02 ee a1 aa ff ff 9f e1 d9 56 30 f8 0e e5 03 00 a9 42 84 3d df 8f a6 8f 00 00 00 00 49 45 4e 44 ae 42 60 82

[fishy]

This is the original file.

Just started fuzzing image/png, and it took about an hour to get the very same crasher.

[dgryski]

Seems like the last time png was fuzzed was ~2 years ago: https://github.com/dvyukov/go-fuzz/tree/master/examples/png ?

[gopherbot]

CL https://golang.org/cl/38271 mentions this issue.

[hyhlinux]

hi @gopherbot , i get the sam err.
the pic url:https://github.com/hyhlinux/docker/blob/master/bug/pngBug.png

[bradfitz]

@hyhlinux, if you still get an error, please file a new (and complete) bug report, including details of which version of Go you're using.

This issue is closed and replies are not necessarily tracked.