Fix chunk end iteration and track APNG frames #216
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Iterating decoding events after a frame was finished would incorrectly consume data in the input buffer when it was not yet handled completely for ignored events.
The decoder would previously only very roughly be able to differentiate between the full IDAT frame and frames with frame control. Since each frame control chunk can set its own width and height data that overrides the global IHDR width and height (which one should think of as dimensions of a background canvas) this would then cause interlace and row iteration to process wrong data. In particular it would mix pixel values and predictor bytes leading to the observable error having encountered an incorrect filter that is far outside the range of specified values.
This dramatically speeds up fuzzer execution, quite naturally.
This fixes an DOS through OOM as well, as the decoder would allocate a buffer with the full line width of the subframe before trying to decode it and before the user provides their own buffer.
The test is added into the usual bug fix test directory but included into the binary for an internal regression test. This makes more sense as it test 'internal' properties. It was also minimized before.
HeroicKatora
changed the title
|
I've fuzzed after this and no results for ~5 hours of fuzzing while the faults introduced were found after 20 minutes each. Should be fine. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes: #214
Closes: #215