Add check for enough data in ReadInternationalTextChunk()

brianpopow · brianpopow · commit fca50b9678ae · 2026-03-10T16:44:44.000+01:00
diff --git a/src/ImageSharp/Formats/Png/PngDecoderCore.cs b/src/ImageSharp/Formats/Png/PngDecoderCore.cs
@@ -1937,6 +1937,11 @@ private void ReadInternationalTextChunk(ImageMetadata metadata, ReadOnlySpan<byt
             return;
         }
 
+        if (zeroIndexKeyword < 0 || zeroIndexKeyword + 4 > data.Length)
+        {
+            return; // Not enough data for keyword + null + flag + method + language.
+        }
+
         byte compressionFlag = data[zeroIndexKeyword + 1];
         if (compressionFlag is not (0 or 1))
         {

Original file line number	Diff line number	Diff line change
`@@ -1937,6 +1937,11 @@ private void ReadInternationalTextChunk(ImageMetadata metadata, ReadOnlySpan<byt`
`1937`	`1937`	`return;`
`1938`	`1938`	`}`
`1939`	`1939`
	`1940`	`+ if (zeroIndexKeyword < 0 \|\| zeroIndexKeyword + 4 > data.Length)`
	`1941`	`+ {`
	`1942`	`+ return; // Not enough data for keyword + null + flag + method + language.`
	`1943`	`+ }`
	`1944`	`+`
`1940`	`1945`	`byte compressionFlag = data[zeroIndexKeyword + 1];`
`1941`	`1946`	`if (compressionFlag is not (0 or 1))`
`1942`	`1947`	`{`