diff --git a/src/ImageSharp/Formats/Gif/GifDecoderCore.cs b/src/ImageSharp/Formats/Gif/GifDecoderCore.cs index 80ee3d130..ae20be7d5 100644 --- a/src/ImageSharp/Formats/Gif/GifDecoderCore.cs +++ b/src/ImageSharp/Formats/Gif/GifDecoderCore.cs @@ -155,10 +155,15 @@ namespace SixLabors.ImageSharp.Formats.Gif this.ReadComments(); break; case GifConstants.ApplicationExtensionLabel: - this.Skip(12); // No need to read. + + // The application extension length should be 11 but we've got test images that incorrectly + // set this to 252. + int appLength = stream.ReadByte(); + this.Skip(appLength); // No need to read. break; case GifConstants.PlainTextLabel: - this.Skip(13); // Not supported by any known decoder. + int plainLength = stream.ReadByte(); + this.Skip(plainLength); // Not supported by any known decoder. break; } } @@ -438,7 +443,8 @@ namespace SixLabors.ImageSharp.Formats.Gif var rgba = new Rgba32(0, 0, 0, 255); - for (int x = descriptor.Left; x < descriptor.Left + descriptor.Width; x++) + // #403 The left + width value can be larger than the image width + for (int x = descriptor.Left; x < descriptor.Left + descriptor.Width && x < rowSpan.Length; x++) { int index = indices[i]; diff --git a/tests/ImageSharp.Tests/Formats/Gif/GifDecoderTests.cs b/tests/ImageSharp.Tests/Formats/Gif/GifDecoderTests.cs index a4a27bd83..76a31c186 100644 --- a/tests/ImageSharp.Tests/Formats/Gif/GifDecoderTests.cs +++ b/tests/ImageSharp.Tests/Formats/Gif/GifDecoderTests.cs @@ -18,6 +18,7 @@ namespace SixLabors.ImageSharp.Tests public static readonly string[] TestFiles = { TestImages.Gif.Giphy, TestImages.Gif.Rings, TestImages.Gif.Trans }; + public static readonly string[] BadAppExtFiles = { TestImages.Gif.Issues.BadAppExtLength, TestImages.Gif.Issues.BadAppExtLength_2 }; [Theory] [WithFileCollection(nameof(TestFiles), PixelTypes)] @@ -30,6 +31,7 @@ namespace SixLabors.ImageSharp.Tests imageProvider.Utility.SaveTestOutputFile(image, "gif"); } } + [Theory] [WithFileCollection(nameof(TestFiles), PixelTypes)] public void DecodeResizeAndSave(TestImageProvider imageProvider) @@ -132,5 +134,27 @@ namespace SixLabors.ImageSharp.Tests } } } + + [Theory] + [WithFileCollection(nameof(BadAppExtFiles), PixelTypes.Rgba32)] + public void DecodeBadApplicationExtensionLength(TestImageProvider imageProvider) + where TPixel : struct, IPixel + { + using (Image image = imageProvider.GetImage()) + { + imageProvider.Utility.SaveTestOutputFile(image, "bmp"); + } + } + + [Theory] + [WithFile(TestImages.Gif.Issues.BadDescriptorWidth, PixelTypes.Rgba32)] + public void DecodeBadDescriptorDimensionsLength(TestImageProvider provider) + where TPixel : struct, IPixel + { + using (Image image = provider.GetImage()) + { + provider.Utility.SaveTestOutputFile(image, "bmp"); + } + } } } \ No newline at end of file diff --git a/tests/ImageSharp.Tests/TestImages.cs b/tests/ImageSharp.Tests/TestImages.cs index 7e98e50ad..365aea04a 100644 --- a/tests/ImageSharp.Tests/TestImages.cs +++ b/tests/ImageSharp.Tests/TestImages.cs @@ -157,6 +157,13 @@ namespace SixLabors.ImageSharp.Tests public const string Trans = "Gif/trans.gif"; public const string Kumin = "Gif/kumin.gif"; + public class Issues + { + public const string BadAppExtLength = "Gif/issues/issue405_badappextlength252.gif"; + public const string BadAppExtLength_2 = "Gif/issues/issue405_badappextlength252-2.gif"; + public const string BadDescriptorWidth = "Gif/issues/issue403_baddescriptorwidth.gif"; + } + public static readonly string[] All = { Rings, Giphy, Cheers, Trans, Kumin }; } } diff --git a/tests/Images/Input/Gif/issues/issue403_baddescriptorwidth.gif b/tests/Images/Input/Gif/issues/issue403_baddescriptorwidth.gif new file mode 100644 index 000000000..fd13fbfb7 Binary files /dev/null and b/tests/Images/Input/Gif/issues/issue403_baddescriptorwidth.gif differ diff --git a/tests/Images/Input/Gif/issues/issue405_badappextlength252-2.gif b/tests/Images/Input/Gif/issues/issue405_badappextlength252-2.gif new file mode 100644 index 000000000..6b7caa31d Binary files /dev/null and b/tests/Images/Input/Gif/issues/issue405_badappextlength252-2.gif differ diff --git a/tests/Images/Input/Gif/issues/issue405_badappextlength252.gif b/tests/Images/Input/Gif/issues/issue405_badappextlength252.gif new file mode 100644 index 000000000..f3e36c941 Binary files /dev/null and b/tests/Images/Input/Gif/issues/issue405_badappextlength252.gif differ