image-rs / image

Encoding and decoding images in Rust
Apache License 2.0
4.86k stars 597 forks source link

Random crashes when decoding exr file #2283

Closed qarmin closed 1 month ago

qarmin commented 1 month ago

Code

fn check_file(file_path: &str) {
    let res = match image::open(file_path) {
        Ok(res) => res,
        Err(e) => {
            eprintln!("Error: {}", e);
            return;
        }
    };

    for format in [
        ImageFormat::Bmp,
        ImageFormat::Farbfeld,
        ImageFormat::Ico,
        ImageFormat::Jpeg,
        ImageFormat::Png,
        ImageFormat::Pnm,
        ImageFormat::Tiff,
        ImageFormat::WebP,
        ImageFormat::Tga,
        ImageFormat::Dds,
        ImageFormat::Hdr,
        ImageFormat::OpenExr,
        ImageFormat::Qoi,
    ]
        .into_iter()
    {
        let buffer: Vec<u8> = Vec::new();
        if let Err(e) = res.write_to(&mut Cursor::new(buffer), format) {
            eprintln!("Error: {}", e);
        };
    }
}

When testing with this code ~100 copies of - compressed.zip, then randomly ~5/10 images crashes during processing with info

Error: Format error decoding OpenExr: invalid: scan line block sample count
thread 'OpenEXR Block Decompressor Thread #3' panicked at /home/rafal/.cargo/registry/src/index.crates.io-6f17d22bba15001f/exr-1.72.0/src/compression/piz/huffman.rs:204:5:
attempt to subtract with overflow
stack backtrace:

##### Automatic Fuzzer note, output status "Some(0)", output signal "None"
HeroicKatora commented 1 month ago

Should this be filed upstream with exr or do you think it's related to misuse of the library within image?

qarmin commented 1 month ago

I was able to reproduce this without image-rs library - https://github.com/johannesvollmer/exrs/issues/237