Merge pull request #2021 from SixLabors/bp/invalidgamma

PNG: Ignore invalid gamma chunks

Author: brianpopow

src/ImageSharp/Formats/Png/PngDecoderCore.cs

@@ -429,10 +429,17 @@ private void ReadPhysicalChunk(ImageMetadata metadata, ReadOnlySpan<byte> data)
         /// <param name="pngMetadata">The metadata to read to.</param>
         /// <param name="data">The data containing physical data.</param>
         private void ReadGammaChunk(PngMetadata pngMetadata, ReadOnlySpan<byte> data)
+        {
+            if (data.Length < 4)
+            {
+                // Ignore invalid gamma chunks.
+                return;
+            }
 
-            // The value is encoded as a 4-byte unsigned integer, representing gamma times 100000.
             // For example, a gamma of 1/2.2 would be stored as 45455.
-            => pngMetadata.Gamma = BinaryPrimitives.ReadUInt32BigEndian(data) * 1e-5F;
+            // The value is encoded as a 4-byte unsigned integer, representing gamma times 100000.
+            pngMetadata.Gamma = BinaryPrimitives.ReadUInt32BigEndian(data) * 1e-5F;
+        }
 
         /// <summary>
         /// Initializes the image and various buffers needed for processing

tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.cs

@@ -281,6 +281,20 @@ public void Decode_MissingPaletteChunk_ThrowsException<TPixel>(TestImageProvider
             Assert.Contains("PNG Image does not contain a palette chunk", ex.Message);
         }
 
+        [Theory]
+        [WithFile(TestImages.Png.Bad.InvalidGammaChunk, PixelTypes.Rgba32)]
+        public void Decode_InvalidGammaChunk_Ignored<TPixel>(TestImageProvider<TPixel> provider)
+            where TPixel : unmanaged, IPixel<TPixel>
+        {
+            Exception ex = Record.Exception(
+                () =>
+                {
+                    using Image<TPixel> image = provider.GetImage(PngDecoder);
+                    image.DebugSave(provider);
+                });
+            Assert.Null(ex);
+        }
+
         [Theory]
         [WithFile(TestImages.Png.Bad.BitDepthZero, PixelTypes.Rgba32)]
         [WithFile(TestImages.Png.Bad.BitDepthThree, PixelTypes.Rgba32)]

tests/ImageSharp.Tests/TestImages.cs

@@ -129,6 +129,7 @@ public static class Bad
                 public const string CorruptedChunk = "Png/big-corrupted-chunk.png";
                 public const string MissingPaletteChunk1 = "Png/missing_plte.png";
                 public const string MissingPaletteChunk2 = "Png/missing_plte_2.png";
+                public const string InvalidGammaChunk = "Png/length_gama.png";
 
                 // Zlib errors.
                 public const string ZlibOverflow = "Png/zlib-overflow.png";