Merge branch 'master' into js/fix-268

src/ImageSharp/Formats/Png/PngDecoderCore.cs

@@ -1124,12 +1124,23 @@ namespace SixLabors.ImageSharp.Formats.Png
         {
             var chunk = new PngChunk();
             this.ReadChunkLength(chunk);
-            if (chunk.Length < 0)
+
+            if (chunk.Length == -1)
             {
+                // IEND
                 return null;
             }
 
+            if (chunk.Length < 0 || chunk.Length > this.currentStream.Length - this.currentStream.Position)
+            {
+                // Not a valid chunk so we skip back all but one of the four bytes we have just read.
+                // That lets us read one byte at a time until we reach a known chunk.
+                this.currentStream.Position -= 3;
+                return chunk;
+            }
+
             this.ReadChunkType(chunk);
+
             if (chunk.Type == PngChunkTypes.Data)
             {
                 return chunk;

tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.cs

@@ -24,6 +24,7 @@ namespace SixLabors.ImageSharp.Tests
                 TestImages.Png.Splash, TestImages.Png.Indexed,
                 TestImages.Png.FilterVar,
                 TestImages.Png.Bad.ChunkLength1,
+                TestImages.Png.Bad.CorruptedChunk,
 
                 TestImages.Png.VimImage1,
                 TestImages.Png.VersioningImage1,

tests/ImageSharp.Tests/TestImages.cs

@@ -56,6 +56,7 @@ namespace SixLabors.ImageSharp.Tests
                 // Odd chunk lengths
                 public const string ChunkLength1 = "Png/chunklength1.png";
                 public const string ChunkLength2 = "Png/chunklength2.png";
+                public const string CorruptedChunk = "Png/big-corrupted-chunk.png";
             }
 
             public static readonly string[] All =

tests/Images/Input/Png/big-corrupted-chunk.png

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:6684985456687682d74b63ad8ef7983f2d6b593a6edc243b1a21c6a64cccf34a
+size 9195