Merge pull request #3080 from SixLabors/bp/fixIssue3078

Add check for span length in parse PNG pHYs chunk

src/ImageSharp/Formats/Png/Chunks/PngPhysical.cs

@@ -46,6 +46,11 @@ internal readonly struct PngPhysical
     /// <returns>The parsed PhysicalChunkData.</returns>
     public static PngPhysical Parse(ReadOnlySpan<byte> data)
     {
+        if (data.Length < 9)
+        {
+            PngThrowHelper.ThrowInvalidImageContentException("pHYs chunk is too short");
+        }
+
         uint hResolution = BinaryPrimitives.ReadUInt32BigEndian(data[..4]);
         uint vResolution = BinaryPrimitives.ReadUInt32BigEndian(data.Slice(4, 4));
         byte unit = data[8];

src/ImageSharp/Formats/Png/PngThrowHelper.cs

@@ -9,8 +9,7 @@ namespace SixLabors.ImageSharp.Formats.Png;
 internal static class PngThrowHelper
 {
     [DoesNotReturn]
-    public static void ThrowInvalidImageContentException(string errorMessage, Exception innerException)
+    public static void ThrowInvalidImageContentException(string errorMessage) => throw new InvalidImageContentException(errorMessage);
-        => throw new InvalidImageContentException(errorMessage, innerException);
 
     [DoesNotReturn]
     public static void ThrowInvalidHeader() => throw new InvalidImageContentException("PNG Image must contain a header chunk and it must be located before any other chunks.");

tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.Chunks.cs

@@ -70,13 +70,28 @@ public partial class PngDecoderTests
             WriteChunk(memStream, chunkName);
             WriteDataChunk(memStream);
 
-            ImageFormatException exception =
+            InvalidImageContentException exception =
                 Assert.Throws<InvalidImageContentException>(() => PngDecoder.Instance.Decode<Rgb24>(DecoderOptions.Default, memStream));
 
             Assert.Equal($"CRC Error. PNG {chunkName} chunk is corrupt!", exception.Message);
         }
     }
 
+    // https://github.com/SixLabors/ImageSharp/issues/3078
+    [Fact]
+    public void Decode_TruncatedPhysChunk_ExceptionIsThrown()
+    {
+        // 24 bytes — PNG signature + truncated pHYs chunk
+        byte[] payload = Convert.FromHexString(
+            "89504e470d0a1a0a3030303070485973" +
+            "3030303030303030");
+
+        using MemoryStream stream = new(payload);
+        InvalidImageContentException exception = Assert.Throws<InvalidImageContentException>(() => Image.Load<Rgba32>(stream));
+
+        Assert.Equal("pHYs chunk is too short", exception.Message);
+    }
+
     private static string GetChunkTypeName(uint value)
     {
         byte[] data = new byte[4];