diff --git a/src/ImageSharp/Formats/Png/Chunks/FrameControl.cs b/src/ImageSharp/Formats/Png/Chunks/FrameControl.cs
index 91f79c8154..0038b41344 100644
--- a/src/ImageSharp/Formats/Png/Chunks/FrameControl.cs
+++ b/src/ImageSharp/Formats/Png/Chunks/FrameControl.cs
@@ -147,7 +147,13 @@ internal readonly struct FrameControl
/// The data to parse.
/// The parsed fcTL.
public static FrameControl Parse(ReadOnlySpan data)
- => new(
+ {
+ if (data.Length < Size)
+ {
+ PngThrowHelper.ThrowInvalidImageContentException("The frame control chunk does not contain enough data!");
+ }
+
+ return new(
sequenceNumber: BinaryPrimitives.ReadUInt32BigEndian(data[..4]),
width: BinaryPrimitives.ReadUInt32BigEndian(data[4..8]),
height: BinaryPrimitives.ReadUInt32BigEndian(data[8..12]),
@@ -157,4 +163,5 @@ internal readonly struct FrameControl
delayDenominator: BinaryPrimitives.ReadUInt16BigEndian(data[22..24]),
disposalMode: (FrameDisposalMode)(data[24] + 1),
blendMode: (FrameBlendMode)data[25]);
+ }
}
diff --git a/tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.Chunks.cs b/tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.Chunks.cs
index 03dc040186..ed33f71636 100644
--- a/tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.Chunks.cs
+++ b/tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.Chunks.cs
@@ -92,6 +92,22 @@ public partial class PngDecoderTests
Assert.Equal("pHYs chunk is too short", exception.Message);
}
+ // https://github.com/SixLabors/ImageSharp/issues/3093
+ [Fact]
+ public void Decode_TruncatedFrameControlChunk_ExceptionIsThrown()
+ {
+ // PNG signature + truncated frame control chunk
+ byte[] payload = Convert.FromHexString(
+ "89504e470d0a1a0a424d3a00000000007f000000000028030405060000000100" +
+ "000101002000000000000000000000000000ff00006663544cff190000000000" +
+ "010000424d000100000101002000000000");
+
+ using MemoryStream stream = new(payload);
+ InvalidImageContentException exception = Assert.Throws(() => Image.Load(stream));
+
+ Assert.Equal("The frame control chunk does not contain enough data!", exception.Message);
+ }
+
// https://github.com/SixLabors/ImageSharp/issues/3079
[Fact]
public void Decode_CompressedTxtChunk_WithTruncatedData_DoesNotThrow()