go: image/png: panic in Decode

Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (go version)?

1.8

What operating system and processor architecture are you using (go env)?

linux/amd64

What did you do?

Calling png.Decode panicked at image/png.(*decoder).readImagePass, here’s the call stack:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x97f9c8]

goroutine 52345 [running]:
image/png.(*decoder).readImagePass(0xc423806400, 0x7f91a3f47ac8, 0xc42130b6d0, 0x0, 0xc42130b600, 0x0, 0x0, 0xc422d84000, 0xc423806478)
        /usr/local/go/src/image/png/reader.go:615 +0x1028
image/png.(*decoder).decode(0xc423806400, 0x0, 0x0, 0x0, 0x0)
        /usr/local/go/src/image/png/reader.go:365 +0x621
image/png.(*decoder).parseIDAT(0xc423806400, 0x4f, 0xfdb929, 0x4)
        /usr/local/go/src/image/png/reader.go:827 +0x36
image/png.(*decoder).parseChunk(0xc423806400, 0x0, 0x0)
        /usr/local/go/src/image/png/reader.go:887 +0x45a
image/png.Decode(0x1783fe0, 0xc42675ef30, 0xfdad15, 0x1, 0xc42316f740, 0x2)
        /usr/local/go/src/image/png/reader.go:946 +0x161
(caller deducted)

Looking at image/png/reader.go:615, I think it might be because of gray was nil. gray was only initialized before on line 438, in the case of !d.useTransparent, so when d.useTransparent == true and it’s the cbG8 case, it might panic. (I’m no PNG expert so I’m not sure whether that’s a case that’s not supposed to happen)

What did you expect to see?

What did you see instead?

About this issue

  • Original URL
  • State: closed
  • Created 7 years ago
  • Comments: 19 (13 by maintainers)

Commits related to this issue

Most upvoted comments

Seems like the last time png was fuzzed was ~2 years ago: https://github.com/dvyukov/go-fuzz/tree/master/examples/png ?