diff --git a/src/ImageSharp/Formats/Png/Chunks/FrameControl.cs b/src/ImageSharp/Formats/Png/Chunks/FrameControl.cs index 91f79c8154..0038b41344 100644 --- a/src/ImageSharp/Formats/Png/Chunks/FrameControl.cs +++ b/src/ImageSharp/Formats/Png/Chunks/FrameControl.cs @@ -147,7 +147,13 @@ public void WriteTo(Span buffer) /// The data to parse. /// The parsed fcTL. public static FrameControl Parse(ReadOnlySpan data) - => new( + { + if (data.Length < Size) + { + PngThrowHelper.ThrowInvalidImageContentException("The frame control chunk does not contain enough data!"); + } + + return new( sequenceNumber: BinaryPrimitives.ReadUInt32BigEndian(data[..4]), width: BinaryPrimitives.ReadUInt32BigEndian(data[4..8]), height: BinaryPrimitives.ReadUInt32BigEndian(data[8..12]), @@ -157,4 +163,5 @@ public static FrameControl Parse(ReadOnlySpan data) delayDenominator: BinaryPrimitives.ReadUInt16BigEndian(data[22..24]), disposalMode: (FrameDisposalMode)(data[24] + 1), blendMode: (FrameBlendMode)data[25]); + } } diff --git a/tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.Chunks.cs b/tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.Chunks.cs index 03dc040186..ed33f71636 100644 --- a/tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.Chunks.cs +++ b/tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.Chunks.cs @@ -92,6 +92,22 @@ public void Decode_TruncatedPhysChunk_ExceptionIsThrown() Assert.Equal("pHYs chunk is too short", exception.Message); } + // https://github.com/SixLabors/ImageSharp/issues/3093 + [Fact] + public void Decode_TruncatedFrameControlChunk_ExceptionIsThrown() + { + // PNG signature + truncated frame control chunk + byte[] payload = Convert.FromHexString( + "89504e470d0a1a0a424d3a00000000007f000000000028030405060000000100" + + "000101002000000000000000000000000000ff00006663544cff190000000000" + + "010000424d000100000101002000000000"); + + using MemoryStream stream = new(payload); + InvalidImageContentException exception = Assert.Throws(() => Image.Load(stream)); + + Assert.Equal("The frame control chunk does not contain enough data!", exception.Message); + } + // https://github.com/SixLabors/ImageSharp/issues/3079 [Fact] public void Decode_CompressedTxtChunk_WithTruncatedData_DoesNotThrow()