Bounds check. Fix #849 (#851)

src/ImageSharp/Formats/Png/Zlib/ZlibInflateStream.cs

@@ -126,8 +126,9 @@ namespace SixLabors.ImageSharp.Formats.Png.Zlib
             int bytesToRead = Math.Min(count, this.currentDataRemaining);
             this.currentDataRemaining -= bytesToRead;
             int bytesRead = this.innerStream.Read(buffer, offset, bytesToRead);
+            long length = this.innerStream.Length;
 
-            // keep reading data until we've reached the end of the stream or filled the buffer
+            // Keep reading data until we've reached the end of the stream or filled the buffer
             while (this.currentDataRemaining == 0 && bytesRead < count)
             {
                 this.currentDataRemaining = this.getData();
@@ -138,6 +139,12 @@ namespace SixLabors.ImageSharp.Formats.Png.Zlib
                 }
 
                 offset += bytesRead;
+
+                if (offset >= length)
+                {
+                    return bytesRead;
+                }
+
                 bytesToRead = Math.Min(count - bytesRead, this.currentDataRemaining);
                 this.currentDataRemaining -= bytesToRead;
                 bytesRead += this.innerStream.Read(buffer, offset, bytesToRead);

tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.cs

@@ -41,7 +41,8 @@ namespace SixLabors.ImageSharp.Tests.Formats.Png
 
             TestImages.Png.Rgb24BppTrans,
             TestImages.Png.GrayAlpha8Bit,
-            TestImages.Png.Gray1BitTrans
+            TestImages.Png.Gray1BitTrans,
+            TestImages.Png.Bad.ZlibOverflow
         };
 
         public static readonly string[] TestImages48Bpp =

tests/ImageSharp.Tests/TestImages.cs

@@ -85,6 +85,7 @@ namespace SixLabors.ImageSharp.Tests
                 public const string ChunkLength1 = "Png/chunklength1.png";
                 public const string ChunkLength2 = "Png/chunklength2.png";
                 public const string CorruptedChunk = "Png/big-corrupted-chunk.png";
+                public const string ZlibOverflow = "Png/zlib-overflow.png";
             }
 
             public static readonly string[] All =