Merge pull request #3094 from SixLabors/bp/Issue3093

PNG: Throw InvalidImageContentException when frame control chunk does not have enough data

src/ImageSharp/Formats/Png/Chunks/FrameControl.cs

@@ -147,7 +147,13 @@ internal readonly struct FrameControl
     /// <param name="data">The data to parse.</param>
     /// <returns>The parsed fcTL.</returns>
     public static FrameControl Parse(ReadOnlySpan<byte> data)
-        => new(
+    {
+        if (data.Length < Size)
+        {
+            PngThrowHelper.ThrowInvalidImageContentException("The frame control chunk does not contain enough data!");
+        }
+
+        return new(
             sequenceNumber: BinaryPrimitives.ReadUInt32BigEndian(data[..4]),
             width: BinaryPrimitives.ReadUInt32BigEndian(data[4..8]),
             height: BinaryPrimitives.ReadUInt32BigEndian(data[8..12]),
@@ -157,4 +163,5 @@ internal readonly struct FrameControl
             delayDenominator: BinaryPrimitives.ReadUInt16BigEndian(data[22..24]),
             disposalMode: (FrameDisposalMode)(data[24] + 1),
             blendMode: (FrameBlendMode)data[25]);
+    }
 }

tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.Chunks.cs

@@ -92,6 +92,22 @@ public partial class PngDecoderTests
         Assert.Equal("pHYs chunk is too short", exception.Message);
     }
 
+    // https://github.com/SixLabors/ImageSharp/issues/3093
+    [Fact]
+    public void Decode_TruncatedFrameControlChunk_ExceptionIsThrown()
+    {
+        // PNG signature + truncated frame control chunk
+        byte[] payload = Convert.FromHexString(
+            "89504e470d0a1a0a424d3a00000000007f000000000028030405060000000100" +
+            "000101002000000000000000000000000000ff00006663544cff190000000000" +
+            "010000424d000100000101002000000000");
+
+        using MemoryStream stream = new(payload);
+        InvalidImageContentException exception = Assert.Throws<InvalidImageContentException>(() => Image.Load<Rgba32>(stream));
+
+        Assert.Equal("The frame control chunk does not contain enough data!", exception.Message);
+    }
+
     // https://github.com/SixLabors/ImageSharp/issues/3079
     [Fact]
     public void Decode_CompressedTxtChunk_WithTruncatedData_DoesNotThrow()