Reject duplicate PNG headers

src/ImageSharp/Formats/Png/PngDecoderCore.cs

@@ -195,11 +195,6 @@ internal sealed class PngDecoderCore : ImageDecoderCore
                     switch (chunk.Type)
                     {
                         case PngChunkType.Header:
-                            if (!Equals(this.header, default(PngHeader)))
-                            {
-                                PngThrowHelper.ThrowInvalidHeader();
-                            }
-
                             this.ReadHeaderChunk(pngMetadata, chunk.Data.GetSpan());
                             break;
                         case PngChunkType.AnimationControl:
@@ -1439,6 +1434,11 @@ internal sealed class PngDecoderCore : ImageDecoderCore
     /// <param name="data">The <see cref="T:ReadOnlySpan{byte}"/> containing data.</param>
     private void ReadHeaderChunk(PngMetadata pngMetadata, ReadOnlySpan<byte> data)
     {
+        if (!Equals(this.header, default(PngHeader)))
+        {
+            PngThrowHelper.ThrowInvalidHeader();
+        }
+
         this.header = PngHeader.Parse(data);
 
         this.header.Validate();

tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.Chunks.cs

@@ -108,6 +108,19 @@ public partial class PngDecoderTests
         Assert.Equal("The frame control chunk does not contain enough data!", exception.Message);
     }
 
+    [Fact]
+    public void DecodeAndIdentify_WithDuplicateHeader_ThrowInvalidImageContentException()
+    {
+        using MemoryStream payloadStream = new();
+        payloadStream.Write(Raw1X1PngIhdrAndpHYs);
+        payloadStream.Write(Raw1X1PngIhdrAndpHYs.AsSpan(8, 25));
+        payloadStream.Write(Raw1X1PngIdatAndIend);
+        byte[] payload = payloadStream.ToArray();
+
+        Assert.Throws<InvalidImageContentException>(() => Image.Load(payload));
+        Assert.Throws<InvalidImageContentException>(() => Image.Identify(payload));
+    }
+
     // https://github.com/SixLabors/ImageSharp/issues/3079
     [Fact]
     public void Decode_CompressedTxtChunk_WithTruncatedData_DoesNotThrow()