search

image-rs / image-png

PNG decoding and encoding library in pure Rust
https://docs.rs/png
Apache License 2.0
347 stars 139 forks source link

Crash when width=0 #438

Closed fintelia closed 6 months ago

fintelia commented 7 months ago

oss-fuzz detected a crash when given a PNG with a zero-sized width. We should reject any image that has a width or height of zero.

Test case: clusterfuzz-testcase-minimized-decode-4787215086256128

backtrace:


#11 0x5a3b7cac04f0 in core::slice::_$LT$impl$u20$$u5b$T$u5d$$GT$::chunks_exact_mut::h0e0c1e7467f87015 /rustc/d12c6e947ceacf3b22c154caf9532b390d8dc88a/library/core/src/slice/mod.rs:1225:9
#12 0x5a3b7cac04f0 in png::decoder::Reader$LT$R$GT$::next_frame::h42665d048034458e [image-png/src/decoder/mod.rs:525](https://github.com/image-rs/image-png/blob/3b3f2e379040a029d14487ea2eaae1da4d477bd6/src/decoder/mod.rs#L525):24
#13 0x5a3b7cad8dbe in decode::png_decode::h8eccdf7a9c7ab6d8 [image-png/fuzz/fuzz_targets/decode.rs:18](https://github.com/image-rs/image-png/blob/3b3f2e379040a029d14487ea2eaae1da4d477bd6/fuzz/fuzz_targets/decode.rs#L18):26