Merge pull request #3084 from SixLabors/bp/fixIssue3082

PNG: Should Not Throw Exception when alpha.Length > colorTable.Length in tRNS chunk

src/ImageSharp/Formats/Png/PngDecoderCore.cs

@@ -1253,6 +1253,12 @@ internal sealed class PngDecoderCore : ImageDecoderCore
         ReadOnlySpan<Rgb24> rgbTable = MemoryMarshal.Cast<byte, Rgb24>(palette);
         Color.FromPixel(rgbTable, colorTable);
 
+        // The tRNS chunk must not contain more alpha values than there are palette entries.
+        if (alpha.Length > colorTable.Length)
+        {
+            alpha = alpha.Slice(0, colorTable.Length);
+        }
+
         if (alpha.Length > 0)
         {
             // The alpha chunk may contain as many transparency entries as there are palette entries

tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.Chunks.cs

@@ -161,6 +161,29 @@ public partial class PngDecoderTests
         using Image<Rgba32> image = Image.Load<Rgba32>(stream);
     }
 
+    [Fact]
+    public void Decode_tRnsChunk_WithAlphaLengthGreaterColorTableLength_ShouldNotThrowException()
+    {
+        byte[] payload = [137, 80, 78, 71, 13, 10, 26, 10, // PNG signature
+                            0, 0, 0, 13, // chunk length 13 bytes
+                            73, 72, 68, 82, // chunk type IHDR
+                            0, 0, 0, 1, 0, 0, 0, 1, 8, 3, 0, 0, 0, // data
+                            40, 203, 52, 187, // crc
+                            0, 0, 0, 6, // chunk length 6 bytes
+                            80, 76, 84, 69, // chunk type palettte
+                            255, 0, 0, 0, 255, 0, // data
+                            210, 135, 239, 113, // crc
+                            0, 0, 0, 18, // chunk length
+                            116, 82, 78, 83, // chunk type tRns
+                            48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, // data
+                            0, 0, 0, 10, // chunk length
+                            73, 68, 65, 84, // chunk type data
+                            120, 156, 99, 96, 0, 0, 0, 2, 0, 1, 72, 175, 164, 113]; // alpha.Length > colorTable.Length
+
+        using MemoryStream stream = new(payload);
+        using Image<Rgba32> image = Image.Load<Rgba32>(stream);
+    }
+
     private static string GetChunkTypeName(uint value)
     {
         byte[] data = new byte[4];