Merge pull request #3134 from SixLabors/js/fix-pbm-dcoder

Validate PBM max pixel value

src/ImageSharp/Formats/Pbm/PbmDecoderCore.cs

@@ -155,6 +155,11 @@ internal sealed class PbmDecoderCore : ImageDecoderCore
                 ThrowPrematureEof();
             }
 
+            if (this.maxPixelValue <= 0 || this.maxPixelValue >= 65536)
+            {
+                throw new InvalidImageContentException("Invalid max pixel value.");
+            }
+
             if (this.maxPixelValue > 255)
             {
                 this.componentType = PbmComponentType.Short;

tests/ImageSharp.Tests/Formats/Pbm/PbmDecoderTests.cs

@@ -123,6 +123,19 @@ public class PbmDecoderTests
             appendPixelTypeToFileName: false);
     }
 
+    [Theory]
+    [InlineData("P2")]
+    [InlineData("P3")]
+    [InlineData("P5")]
+    [InlineData("P6")]
+    public void Decode_MaxPixelValueZero_ThrowsInvalidImageContentException(string magic)
+    {
+        byte[] bytes = Encoding.ASCII.GetBytes($"{magic} 1 1 0\n0");
+        using MemoryStream stream = new(bytes);
+
+        Assert.Throws<InvalidImageContentException>(() => Image.Load<Rgba32>(stream));
+    }
+
     [Fact]
     public void PlainText_PrematureEof()
     {