Merge branch 'master' into bp/alphadecodingsse

src/ImageSharp/Formats/Jpeg/JpegDecoderCore.cs

@@ -472,7 +472,7 @@ namespace SixLabors.ImageSharp.Formats.Jpeg
                     : JpegColorSpace.Cmyk;
             }
 
-            JpegThrowHelper.ThrowInvalidImageContentException($"Unsupported color mode. Supported component counts 1, 3, and 4; found {componentCount}");
+            JpegThrowHelper.ThrowNotSupportedComponentCount(componentCount);
             return default;
         }
 
@@ -998,6 +998,14 @@ namespace SixLabors.ImageSharp.Formats.Jpeg
             // 1 byte: Number of components
             byte componentCount = this.temp[5];
 
+            // Validate: componentCount more than 4 can lead to a buffer overflow during stream
+            // reading so we must limit it to 4
+            // We do not support jpeg images with more than 4 components anyway
+            if (componentCount > 4)
+            {
+                JpegThrowHelper.ThrowNotSupportedComponentCount(componentCount);
+            }
+
             this.Frame = new JpegFrame(frameMarker, precision, frameWidth, frameHeight, componentCount);
 
             remaining -= length;

src/ImageSharp/Formats/Jpeg/JpegThrowHelper.cs

@@ -45,5 +45,8 @@ namespace SixLabors.ImageSharp.Formats.Jpeg
 
         [MethodImpl(InliningOptions.ColdPath)]
         public static void ThrowDimensionsTooLarge(int width, int height) => throw new ImageFormatException($"Image is too large to encode at {width}x{height} for JPEG format.");
+
+        [MethodImpl(InliningOptions.ColdPath)]
+        public static void ThrowNotSupportedComponentCount(int componentCount) => throw new NotSupportedException($"Images with {componentCount} components are not supported.");
     }
 }

tests/ImageSharp.Tests/Formats/Jpg/JpegDecoderTests.Images.cs

@@ -63,6 +63,20 @@ namespace SixLabors.ImageSharp.Tests.Formats.Jpg
             TestImages.Jpeg.Issues.OrderedInterleavedProgressive723C
         };
 
+        public static string[] UnsupportedTestJpegs =
+        {
+            // Invalid componentCount value (2 or > 4)
+            TestImages.Jpeg.Issues.Fuzz.NullReferenceException823,
+            TestImages.Jpeg.Issues.MalformedUnsupportedComponentCount,
+
+            // Arithmetic coding
+            TestImages.Jpeg.Baseline.ArithmeticCoding,
+            TestImages.Jpeg.Baseline.ArithmeticCodingProgressive,
+
+            // Lossless jpeg
+            TestImages.Jpeg.Baseline.Lossless
+        };
+
         public static string[] UnrecoverableTestJpegs =
         {
             TestImages.Jpeg.Issues.CriticalEOF214,
@@ -70,7 +84,6 @@ namespace SixLabors.ImageSharp.Tests.Formats.Jpg
             TestImages.Jpeg.Issues.Fuzz.AccessViolationException798,
             TestImages.Jpeg.Issues.Fuzz.DivideByZeroException821,
             TestImages.Jpeg.Issues.Fuzz.DivideByZeroException822,
-            TestImages.Jpeg.Issues.Fuzz.NullReferenceException823,
             TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException824A,
             TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException824B,
             TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException824D,
@@ -91,8 +104,7 @@ namespace SixLabors.ImageSharp.Tests.Formats.Jpg
             TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException824C,
         };
 
-        private static readonly Dictionary<string, float> CustomToleranceValues =
+        private static readonly Dictionary<string, float> CustomToleranceValues = new()
-            new Dictionary<string, float>
         {
             // Baseline:
             [TestImages.Jpeg.Baseline.Calliphora] = 0.00002f / 100,

tests/ImageSharp.Tests/Formats/Jpg/JpegDecoderTests.cs

@@ -190,9 +190,7 @@ namespace SixLabors.ImageSharp.Tests.Formats.Jpg
         }
 
         [Theory]
-        [WithFile(TestImages.Jpeg.Baseline.ArithmeticCoding, PixelTypes.Rgba32)]
+        [WithFileCollection(nameof(UnsupportedTestJpegs), PixelTypes.Rgba32)]
-        [WithFile(TestImages.Jpeg.Baseline.ArithmeticCodingProgressive, PixelTypes.Rgba32)]
-        [WithFile(TestImages.Jpeg.Baseline.Lossless, PixelTypes.Rgba32)]
         public void ThrowsNotSupported_WithUnsupportedJpegs<TPixel>(TestImageProvider<TPixel> provider)
             where TPixel : unmanaged, IPixel<TPixel>
         {

tests/ImageSharp.Tests/TestImages.cs

@@ -256,6 +256,7 @@ namespace SixLabors.ImageSharp.Tests
                 public const string BadSubSampling1076 = "Jpg/issues/issue-1076-invalid-subsampling.jpg";
                 public const string IdentifyMultiFrame1211 = "Jpg/issues/issue-1221-identify-multi-frame.jpg";
                 public const string WrongColorSpace = "Jpg/issues/Issue1732-WrongColorSpace.jpg";
+                public const string MalformedUnsupportedComponentCount = "Jpg/issues/issue-1900-malformed-unsupported-255-components.jpg";
 
                 public static class Fuzz
                 {

tests/Images/Input/Jpg/issues/issue-1900-malformed-unsupported-255-components.jpg

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:f3553f76b72b98986df13a7508cd073a30b7c846dc441d1d68a518bf7b93bc66
+size 3951