Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Image.Load throws IndexOutOfRangeException #824

Closed
4 tasks done
Metalnem opened this issue Jan 28, 2019 · 0 comments
Closed
4 tasks done

Image.Load throws IndexOutOfRangeException #824

Metalnem opened this issue Jan 28, 2019 · 0 comments
Assignees
@JimBobSquarePants
Labels
bug formats:jpeg
Milestone
1.0.0-rc1

Comments

@Metalnem
Copy link

Prerequisites

  • I have written a descriptive issue title
  • I have verified that I am running the latest version of ImageSharp
  • I have verified if the problem exist in both DEBUG and RELEASE mode
  • I have searched open and closed issues to ensure it has not already been reported

Description

Image.Load throws IndexOutOfRangeException when loading malformed JPG file.

Steps to Reproduce

Run the following code snippet with the path variable containing the path to one of the files from the attached archive:

Image.Load(path);

There are eight different stack traces in total for this exception type, which is why I bundled them together in a single issue (also, I'm not sure which one of these might be the part of the same issue, because some stack traces look quite similar). Here are all the stack traces:

Image 1

System.IndexOutOfRangeException: Index was outside the bounds of the array.
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoderCore.ProcessDefineQuantizationTablesMarker(Int32 remaining)
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoderCore.ParseStream(Stream stream, Boolean metadataOnly)
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoderCore.Decode[TPixel](Stream stream)
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoder.Decode[TPixel](Configuration configuration, Stream stream)
   at SixLabors.ImageSharp.Image.Decode[TPixel](Stream stream, Configuration config)
   at SixLabors.ImageSharp.Image.WithSeekableStream[T](Configuration config, Stream stream, Func`2 action)
   at SixLabors.ImageSharp.Image.Load[TPixel](Configuration config, Stream stream, IImageFormat& format)
   at SixLabors.ImageSharp.Image.Load[TPixel](Configuration config, Byte[] data)

Image 2

System.IndexOutOfRangeException: Index was outside the bounds of the array.
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoderCore.ProcessDefineHuffmanTablesMarker(Int32 remaining)
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoderCore.ParseStream(Stream stream, Boolean metadataOnly)
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoderCore.Decode[TPixel](Stream stream)
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoder.Decode[TPixel](Configuration configuration, Stream stream)
   at SixLabors.ImageSharp.Image.Decode[TPixel](Stream stream, Configuration config)
   at SixLabors.ImageSharp.Image.WithSeekableStream[T](Configuration config, Stream stream, Func`2 action)
   at SixLabors.ImageSharp.Image.Load[TPixel](Configuration config, Stream stream, IImageFormat& format)
   at SixLabors.ImageSharp.Image.Load[TPixel](Configuration config, Byte[] data)

Image 3

System.IndexOutOfRangeException: Index was outside the bounds of the array.
   at SixLabors.ImageSharp.Formats.Jpeg.Components.Decoder.ScanDecoder.ParseBaselineDataInterleaved()
   at SixLabors.ImageSharp.Formats.Jpeg.Components.Decoder.ScanDecoder.ParseEntropyCodedData()
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoderCore.ParseStream(Stream stream, Boolean metadataOnly)
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoderCore.Decode[TPixel](Stream stream)
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoder.Decode[TPixel](Configuration configuration, Stream stream)
   at SixLabors.ImageSharp.Image.Decode[TPixel](Stream stream, Configuration config)
   at SixLabors.ImageSharp.Image.WithSeekableStream[T](Configuration config, Stream stream, Func`2 action)
   at SixLabors.ImageSharp.Image.Load[TPixel](Configuration config, Stream stream, IImageFormat& format)
   at SixLabors.ImageSharp.Image.Load[TPixel](Configuration config, Byte[] data)

Image 4

System.IndexOutOfRangeException: Index was outside the bounds of the array.
   at SixLabors.ImageSharp.Formats.Jpeg.Components.Decoder.JpegBlockPostProcessor..ctor(IRawJpegData decoder, IJpegComponent component)
   at SixLabors.ImageSharp.Formats.Jpeg.Components.Decoder.JpegComponentPostProcessor.CopyBlocksToColorBuffer()
   at SixLabors.ImageSharp.Formats.Jpeg.Components.Decoder.JpegImagePostProcessor.DoPostProcessorStep[TPixel](ImageFrame`1 destination)
   at SixLabors.ImageSharp.Formats.Jpeg.Components.Decoder.JpegImagePostProcessor.PostProcess[TPixel](ImageFrame`1 destination)
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoderCore.PostProcessIntoImage[TPixel]()
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoder.Decode[TPixel](Configuration configuration, Stream stream)
   at SixLabors.ImageSharp.Image.Decode[TPixel](Stream stream, Configuration config)
   at SixLabors.ImageSharp.Image.WithSeekableStream[T](Configuration config, Stream stream, Func`2 action)
   at SixLabors.ImageSharp.Image.Load[TPixel](Configuration config, Stream stream, IImageFormat& format)
   at SixLabors.ImageSharp.Image.Load[TPixel](Configuration config, Byte[] data)

Image 5

System.IndexOutOfRangeException: Index was outside the bounds of the array.
   at SixLabors.ImageSharp.Formats.Jpeg.Components.Decoder.ScanDecoder.DecodeBlockBaseline(JpegComponent component, Block8x8& block, HuffmanTable& dcTable, HuffmanTable& acTable, Int16& fastACRef)
   at SixLabors.ImageSharp.Formats.Jpeg.Components.Decoder.ScanDecoder.ParseBaselineDataInterleaved()
   at SixLabors.ImageSharp.Formats.Jpeg.Components.Decoder.ScanDecoder.ParseEntropyCodedData()
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoderCore.ParseStream(Stream stream, Boolean metadataOnly)
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoderCore.Decode[TPixel](Stream stream)
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoder.Decode[TPixel](Configuration configuration, Stream stream)
   at SixLabors.ImageSharp.Image.Decode[TPixel](Stream stream, Configuration config)
   at SixLabors.ImageSharp.Image.WithSeekableStream[T](Configuration config, Stream stream, Func`2 action)
   at SixLabors.ImageSharp.Image.Load[TPixel](Configuration config, Stream stream, IImageFormat& format)
   at SixLabors.ImageSharp.Image.Load[TPixel](Configuration config, Byte[] data)

Image 6

System.IndexOutOfRangeException: Index was outside the bounds of the array.
   at SixLabors.ImageSharp.Formats.Jpeg.Components.Block8x8F.CopyArbitraryScale(BufferArea`1 area, Int32 horizontalScale, Int32 verticalScale)
   at SixLabors.ImageSharp.Formats.Jpeg.Components.Decoder.JpegBlockPostProcessor.ProcessBlockColorsInto(Block8x8& sourceBlock, BufferArea`1& destArea, Single maximumValue)
   at SixLabors.ImageSharp.Formats.Jpeg.Components.Decoder.JpegComponentPostProcessor.CopyBlocksToColorBuffer()
   at SixLabors.ImageSharp.Formats.Jpeg.Components.Decoder.JpegImagePostProcessor.DoPostProcessorStep[TPixel](ImageFrame`1 destination)
   at SixLabors.ImageSharp.Formats.Jpeg.Components.Decoder.JpegImagePostProcessor.PostProcess[TPixel](ImageFrame`1 destination)
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoderCore.PostProcessIntoImage[TPixel]()
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoder.Decode[TPixel](Configuration configuration, Stream stream)
   at SixLabors.ImageSharp.Image.Decode[TPixel](Stream stream, Configuration config)
   at SixLabors.ImageSharp.Image.WithSeekableStream[T](Configuration config, Stream stream, Func`2 action)
   at SixLabors.ImageSharp.Image.Load[TPixel](Configuration config, Stream stream, IImageFormat& format)
   at SixLabors.ImageSharp.Image.Load[TPixel](Configuration config, Byte[] data)

Image 7

System.IndexOutOfRangeException: Index was outside the bounds of the array.
   at SixLabors.ImageSharp.Formats.Jpeg.Components.Decoder.ScanDecoder.DecodeBlockProgressiveDC(JpegComponent component, Block8x8& block, HuffmanTable& dcTable)
   at SixLabors.ImageSharp.Formats.Jpeg.Components.Decoder.ScanDecoder.ParseProgressiveDataInterleaved()
   at SixLabors.ImageSharp.Formats.Jpeg.Components.Decoder.ScanDecoder.ParseEntropyCodedData()
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoderCore.ParseStream(Stream stream, Boolean metadataOnly)
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoderCore.Decode[TPixel](Stream stream)
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoder.Decode[TPixel](Configuration configuration, Stream stream)
   at SixLabors.ImageSharp.Image.Decode[TPixel](Stream stream, Configuration config)
   at SixLabors.ImageSharp.Image.WithSeekableStream[T](Configuration config, Stream stream, Func`2 action)
   at SixLabors.ImageSharp.Image.Load[TPixel](Configuration config, Stream stream, IImageFormat& format)
   at SixLabors.ImageSharp.Image.Load[TPixel](Configuration config, Byte[] data)

Image 8

System.IndexOutOfRangeException: Index was outside the bounds of the array.
   at SixLabors.ImageSharp.Formats.Jpeg.Components.Decoder.ScanDecoder.ParseProgressiveDataInterleaved()
   at SixLabors.ImageSharp.Formats.Jpeg.Components.Decoder.ScanDecoder.ParseEntropyCodedData()
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoderCore.ParseStream(Stream stream, Boolean metadataOnly)
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoderCore.Decode[TPixel](Stream stream)
   at SixLabors.ImageSharp.Formats.Jpeg.JpegDecoder.Decode[TPixel](Configuration configuration, Stream stream)
   at SixLabors.ImageSharp.Image.Decode[TPixel](Stream stream, Configuration config)
   at SixLabors.ImageSharp.Image.WithSeekableStream[T](Configuration config, Stream stream, Func`2 action)
   at SixLabors.ImageSharp.Image.Load[TPixel](Configuration config, Stream stream, IImageFormat& format)
   at SixLabors.ImageSharp.Image.Load[TPixel](Configuration config, Byte[] data)

System Configuration

  • ImageSharp version: Beta 6
  • Environment (Operating system, version and so on): Windows 10 Pro 1803
  • .NET Framework version: .NET Core 2.2.102

Found via SharpFuzz.
@JimBobSquarePants JimBobSquarePants self-assigned this Feb 13, 2019
@JimBobSquarePants JimBobSquarePants added this to the 1.0.0-rc1 milestone Feb 15, 2019
@JimBobSquarePants JimBobSquarePants mentioned this issue Feb 15, 2019
Merged
11 tasks
JimBobSquarePants added a commit that referenced this issue Feb 16, 2019
@JimBobSquarePants
Check for correct QT index. Touch #824
9722e81
JimBobSquarePants added a commit that referenced this issue Feb 16, 2019
@JimBobSquarePants
Check DHT props. Touch #824
af78ccf
JimBobSquarePants added a commit that referenced this issue Feb 16, 2019
@JimBobSquarePants
Limit sampling factors to 1 & 2. Touch #824
bf55db7
JimBobSquarePants added a commit that referenced this issue Feb 16, 2019
@JimBobSquarePants
Add already fixed image 4. Touch #824
e984f86
JimBobSquarePants added a commit that referenced this issue Feb 16, 2019
@JimBobSquarePants
Check for excessive code lengths. Touch #824
510c363
JimBobSquarePants added a commit that referenced this issue Feb 16, 2019
@JimBobSquarePants
Add already fixed image 6. Touch #824
9efdcb6
JimBobSquarePants added a commit that referenced this issue Feb 16, 2019
@JimBobSquarePants
Lint progressive scan details. Touch #824
8d974c5
JimBobSquarePants added a commit that referenced this issue Feb 16, 2019
@JimBobSquarePants
Add already fixed image 8. Fix #824
c405175
antonfirsov pushed a commit to antonfirsov/ImageSharp that referenced this issue Nov 11, 2019
@JimBobSquarePants
Jpeg Fuzz Fixes (SixLabors#836)
2e241f5 
* Nomalize jpeg exceptions. Fix SixLabors#821

* Fix SixLabors#822

* Fix SixLabors#823

* Check for correct QT index. Touch SixLabors#824

* Check DHT props. Touch SixLabors#824

* Limit sampling factors to 1 & 2. Touch SixLabors#824

* Add already fixed image 4. Touch SixLabors#824

* Check for excessive code lengths. Touch SixLabors#824

* Add already fixed image 6. Touch SixLabors#824

* Lint progressive scan details. Touch SixLabors#824

* Add already fixed image 8. Fix SixLabors#824

* Remove duplicate per-block checks

* Add already fixed image 1. Touch SixLabors#825

* Don't throw on bad JFIF density units.

* Add already fixed image 3. Touch SixLabors#825

* Add already fixed image 4. Fix SixLabors#825

* Check SOFn marker length. Touch SixLabors#826

* Add already fixed image 2. Touch SixLabors#826

* Add already fixed image 3. Fix SixLabors#826

* Add fixed already fixed image. Fix SixLabors#827

* Revert unneeded bounds check introduced in SixLabors#804
antonfirsov added a commit that referenced this issue Mar 10, 2020
@antonfirsov
fix test failure related to #824
0f278e2
@antonfirsov antonfirsov mentioned this issue Dec 15, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@JimBobSquarePants JimBobSquarePants

Labels
bug formats:jpeg
Projects
None yet
Milestone
1.0.0-rc1
Development

No branches or pull requests
2 participants
@JimBobSquarePants @Metalnem