image/png: slice bounds out of range #12545
Description
Run the following program on the following input:
package main import ( "bytes" "image/png" ) func main() { data := "\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x00" + "\x04\x00\x00\x00\x04\x00\x00\x00\x00\x86\xfc\x9f\xc30000IDA" + "T8\x11cn\x000" img, err := png.Decode(bytes.NewReader([]byte(data))) if err != nil { return } var w bytes.Buffer err = png.Encode(&w, img) if err != nil { panic(err) } }It crashes as:
panic: runtime error: index out of range goroutine 1 [running]: image/png.(*decoder).readImagePass(0x8202e8e00, 0x882045b3e8, 0x8203020a0, 0x0, 0x820302000, 0x0, 0x0, 0x0, 0x0) /usr/local/Cellar/go/1.5/libexec/src/image/png/reader.go:472 +0x2780 image/png.(*decoder).decode(0x8202e8e00, 0x0, 0x0, 0x0, 0x0) /usr/local/Cellar/go/1.5/libexec/src/image/png/reader.go:328 +0x1a1 image/png.(*decoder).parseIDAT(0x8202e8e00, 0x30303030, 0x0, 0x0) /usr/local/Cellar/go/1.5/libexec/src/image/png/reader.go:673 +0x3a image/png.(*decoder).parseChunk(0x8202e8e00, 0x0, 0x0) /usr/local/Cellar/go/1.5/libexec/src/image/png/reader.go:722 +0x406 image/png.Decode(0x882045b210, 0x8202e22d0, 0x0, 0x0, 0x0, 0x0) /usr/local/Cellar/go/1.5/libexec/src/image/png/reader.go:778 +0x210 main.main() /Users/bmb/go/src/github.com/bmbernie/pngtest/pngtest.go:13 +0x121