lvandeve / lodepng

PNG encoder and decoder in C and C++.
zlib License
2.03k stars 420 forks source link

chunk type is restricted to the decimal values 65 to 90 and 97 to 122 #181

Open boofish opened 1 year ago

boofish commented 1 year ago

Hi, according to the specification, chunk type is restricted to the decimal values 65 to 90 and 97 to 122.

Maybe this could be fixed at the function decodeGeneric by replacing

else /*it's not an implemented chunk type, so ignore it: skip over the data*/ {
      /*error: unknown critical chunk (5th bit of first byte of chunk type is 0)*/
      if(!state->decoder.ignore_critical && !lodepng_chunk_ancillary(chunk)) {
        CERROR_BREAK(state->error, 69);
      }

with

else /*it's not an implemented chunk type, so ignore it: skip over the data*/ {
      /*error: unknown critical chunk (5th bit of first byte of chunk type is 0)*/
      unsigned i;
      for(i = 0; i != 4; ++i) 
        if (!((chunk[i+4]>='a' && chunk[i+4]<='z') || (chunk[i+4]>='A' && chunk[i+4]<='Z'))) {
            CERROR_BREAK(state->error, 116); // invalid chunk type
        }
      if(!state->decoder.ignore_critical && !lodepng_chunk_ancillary(chunk)) {
        CERROR_BREAK(state->error, 69);
      }

This rule is meaningful and it can allow safe, flexible extension of the PNG format according to the specification.