Decoding bug resulting in chunk length too large

[jeffboody]

I encountered the following error with the attached png and was able to reproduce it with the example_decode program.

error 30: chunk length too large, chunk broken off at end of file

I'm using the most recent version of lodepng from master branch.

commit 8a0f16afe74a6abf85e3b45e9558283022021a59 Author: Lode Vandevenne lvandeve@users.noreply.github.com Date: Thu Dec 22 13:46:52 2016 +0100

Update README.md

Gimp is able to read the file successfully so it seems like a potential decoding bug.

[jeffboody]

I found a workaround to load the png by breaking out of the while loop when encountering the error.

diff --git a/lodepng.cpp b/lodepng.cpp
index 02f7298..5455dd1 100644
--- a/lodepng.cpp
+++ b/lodepng.cpp
@@ -4562,7 +4562,7 @@ static void decodeGeneric(unsigned char** out, unsigned* w, unsigned* h,
     const unsigned char* data; /*the data in the chunk*/

     /*error: size of the in buffer too small to contain next chunk*/
-    if((size_t)((chunk - in) + 12) > insize || chunk < in) CERROR_BREAK(state->error, 30);
+    if((size_t)((chunk - in) + 12) > insize || chunk < in) break;

     /*length of the data of the chunk, excluding the length bytes, chunk type and CRC bytes*/
     chunkLength = lodepng_chunk_length(chunk);