| commit | 8c4ea3140e7c79d828fe7683a3dfe3474a9938fb | [log] [tgz] |
|---|---|---|
| author | Nigel Tao <nigeltao@golang.org> | Fri Oct 08 10:33:47 2021 +1100 |
| committer | Nigel Tao <nigeltao@golang.org> | Fri Oct 08 01:18:01 2021 +0000 |
| tree | fd94e9048861b6f0472898429464166aa14b9a6e | |
| parent | 78d749fbe978bf6eac9c5e11aa4641dc126c9128 [diff] |
image/png: fix interlaced palette out-of-bounds PNG images can be paletted, where each pixel value (a uint8) indexes a slice of colors. In terms of wire format, the PLTE chunk explicitly contains the palette length. However, in practice, some arguably malformed images contain pixel values greater than or equal to the explicit PLTE length. Go's image/png decoder accomodates such images by lengthening the decoded image's palette if the implicit maximum is larger than the explicit maximum. This was already done, prior to this commit, by the "if len(paletted.Palette) <= int(idx)" lines in decoder.readImagePass. Separately, PNG images can also be interlaced, where the final image is the result of merging multiple partial images, also called passes. Prior to this commit, we applied the palette lengthening to the pass images but not the final image. This commit fixes that. Fixes #48612 Change-Id: I77606538cc9a504fbd726071756ebcd10c9da73f Reviewed-on: https://go-review.googlesource.com/c/go/+/354709 Trust: Nigel Tao <nigeltao@golang.org> Reviewed-by: Andrew Gerrand <adg@golang.org>
Go is an open source programming language that makes it easy to build simple, reliable, and efficient software.
Gopher image by Renee French, licensed under Creative Commons 3.0 Attributions license.
Our canonical Git repository is located at https://go.googlesource.com/go. There is a mirror of the repository at https://github.com/golang/go.
Unless otherwise noted, the Go source files are distributed under the BSD-style license found in the LICENSE file.
Official binary distributions are available at https://golang.org/dl/.
After downloading a binary release, visit https://golang.org/doc/install for installation instructions.
If a binary distribution is not available for your combination of operating system and architecture, visit https://golang.org/doc/install/source for source installation instructions.
Go is the work of thousands of contributors. We appreciate your help!
To contribute, please read the contribution guidelines at https://golang.org/doc/contribute.
Note that the Go project uses the issue tracker for bug reports and proposals only. See https://golang.org/wiki/Questions for a list of places to ask questions about the Go language.