Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions src/ImageSharp/Formats/Png/PngDecoderCore.cs
Original file line number Diff line number Diff line change
Expand Up @@ -1253,6 +1253,12 @@ private static void AssignColorPalette(ReadOnlySpan<byte> palette, ReadOnlySpan<
ReadOnlySpan<Rgb24> rgbTable = MemoryMarshal.Cast<byte, Rgb24>(palette);
Color.FromPixel(rgbTable, colorTable);

// The tRNS chunk must not contain more alpha values than there are palette entries.
if (alpha.Length > colorTable.Length)
{
alpha = alpha.Slice(0, colorTable.Length);
}

if (alpha.Length > 0)
{
// The alpha chunk may contain as many transparency entries as there are palette entries
Expand Down
23 changes: 23 additions & 0 deletions tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.Chunks.cs
Original file line number Diff line number Diff line change
Expand Up @@ -161,6 +161,29 @@ public void Decode_InternationalText_WithTruncatedDataAfterLanguageTag_DoesNotTh
using Image<Rgba32> image = Image.Load<Rgba32>(stream);
}

[Fact]
public void Decode_tRnsChunk_WithAlphaLengthGreaterColorTableLength_ShouldNotThrowException()
{
byte[] payload = [137, 80, 78, 71, 13, 10, 26, 10, // PNG signature
0, 0, 0, 13, // chunk length 13 bytes
73, 72, 68, 82, // chunk type IHDR
0, 0, 0, 1, 0, 0, 0, 1, 8, 3, 0, 0, 0, // data
40, 203, 52, 187, // crc
0, 0, 0, 6, // chunk length 6 bytes
80, 76, 84, 69, // chunk type palettte
255, 0, 0, 0, 255, 0, // data
210, 135, 239, 113, // crc
0, 0, 0, 18, // chunk length
116, 82, 78, 83, // chunk type tRns
48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, // data
0, 0, 0, 10, // chunk length
73, 68, 65, 84, // chunk type data
120, 156, 99, 96, 0, 0, 0, 2, 0, 1, 72, 175, 164, 113]; // alpha.Length > colorTable.Length

using MemoryStream stream = new(payload);
using Image<Rgba32> image = Image.Load<Rgba32>(stream);
}

private static string GetChunkTypeName(uint value)
{
byte[] data = new byte[4];
Expand Down
Loading