Fix #3067

Author: JimBobSquarePants

src/ImageSharp/Formats/Bmp/BmpDecoderCore.cs

@@ -126,7 +126,10 @@ protected override Image<TPixel> Decode<TPixel>(BufferedReadStream stream, Cance
             switch (this.infoHeader.Compression)
             {
                 case BmpCompression.RGB:
-                    if (this.infoHeader.BitsPerPixel == 32)
+
+                    ushort bitsPerPixel = this.infoHeader.BitsPerPixel;
+
+                    if (bitsPerPixel == 32)
                     {
                         if (this.bmpMetadata.InfoHeaderType == BmpInfoHeaderType.WinVersion3)
                         {
@@ -137,26 +140,30 @@ protected override Image<TPixel> Decode<TPixel>(BufferedReadStream stream, Cance
                             this.ReadRgb32Fast(stream, pixels, this.infoHeader.Width, this.infoHeader.Height, inverted);
                         }
                     }
-                    else if (this.infoHeader.BitsPerPixel == 24)
+                    else if (bitsPerPixel == 24)
                     {
                         this.ReadRgb24(stream, pixels, this.infoHeader.Width, this.infoHeader.Height, inverted);
                     }
-                    else if (this.infoHeader.BitsPerPixel == 16)
+                    else if (bitsPerPixel == 16)
                     {
                         this.ReadRgb16(stream, pixels, this.infoHeader.Width, this.infoHeader.Height, inverted);
                     }
-                    else if (this.infoHeader.BitsPerPixel <= 8)
+                    else if (bitsPerPixel is > 0 and <= 8)
                     {
                         this.ReadRgbPalette(
                             stream,
                             pixels,
                             palette,
                             this.infoHeader.Width,
                             this.infoHeader.Height,
-                            this.infoHeader.BitsPerPixel,
+                            bitsPerPixel,
                             bytesPerColorMapEntry,
                             inverted);
                     }
+                    else
+                    {
+                        BmpThrowHelper.ThrowInvalidImageContentException($"Invalid bits per pixel: {bitsPerPixel}");
+                    }
 
                     break;
 

tests/ImageSharp.Tests/Formats/Bmp/BmpDecoderTests.cs

@@ -570,4 +570,27 @@ public void BmpDecoder_ThrowsException_Issue2696<TPixel>(TestImageProvider<TPixe
             });
         Assert.IsType<InvalidMemoryOperationException>(ex.InnerException);
     }
+
+    [Fact]
+    public void BmpDecoder_ThrowsException_Issue3067()
+    {
+        // Construct minimal BMP with bitsPerPixel = 0
+        byte[] bmp = new byte[54];
+        bmp[0] = (byte)'B';
+        bmp[1] = (byte)'M';
+        BitConverter.GetBytes(54).CopyTo(bmp, 2);
+        BitConverter.GetBytes(54).CopyTo(bmp, 10);
+        BitConverter.GetBytes(40).CopyTo(bmp, 14);
+        BitConverter.GetBytes(1).CopyTo(bmp, 18);
+        BitConverter.GetBytes(1).CopyTo(bmp, 22);
+        BitConverter.GetBytes((short)1).CopyTo(bmp, 26);
+        BitConverter.GetBytes((short)0).CopyTo(bmp, 28);  // bitsPerPixel = 0
+
+        using MemoryStream stream = new(bmp);
+
+        InvalidImageContentException ex = Assert.Throws<InvalidImageContentException>(() =>
+        {
+            using Image image = BmpDecoder.Instance.Decode(DecoderOptions.Default, stream);
+        });
+    }
 }