Gracefully handle LZW overflows

Author: JimBobSquarePants

src/ImageSharp/Formats/Gif/LzwDecoder.cs

@@ -137,6 +137,7 @@ public void DecodePixelRow(Span<byte> indices)
         ref int suffixRef = ref MemoryMarshal.GetReference(this.suffix.GetSpan());
         ref int pixelStackRef = ref MemoryMarshal.GetReference(this.pixelStack.GetSpan());
         Span<byte> buffer = this.scratchBuffer.GetSpan();
+        int maxTop = this.pixelStack.Length() - 1;
 
         int x = 0;
         int xyz = 0;
@@ -204,7 +205,7 @@ public void DecodePixelRow(Span<byte> indices)
                     this.code = this.oldCode;
                 }
 
-                while (this.code > this.clearCode)
+                while (this.code > this.clearCode && this.top < maxTop)
                 {
                     Unsafe.Add(ref pixelStackRef, (uint)this.top++) = Unsafe.Add(ref suffixRef, (uint)this.code);
                     this.code = Unsafe.Add(ref prefixRef, (uint)this.code);
@@ -250,6 +251,7 @@ public void SkipIndices(int length)
         ref int suffixRef = ref MemoryMarshal.GetReference(this.suffix.GetSpan());
         ref int pixelStackRef = ref MemoryMarshal.GetReference(this.pixelStack.GetSpan());
         Span<byte> buffer = this.scratchBuffer.GetSpan();
+        int maxTop = this.pixelStack.Length() - 1;
 
         int xyz = 0;
         while (xyz < length)
@@ -316,7 +318,7 @@ public void SkipIndices(int length)
                     this.code = this.oldCode;
                 }
 
-                while (this.code > this.clearCode)
+                while (this.code > this.clearCode && this.top < maxTop)
                 {
                     Unsafe.Add(ref pixelStackRef, (uint)this.top++) = Unsafe.Add(ref suffixRef, (uint)this.code);
                     this.code = Unsafe.Add(ref prefixRef, (uint)this.code);

tests/ImageSharp.Tests/Formats/Gif/GifDecoderTests.cs

@@ -334,4 +334,16 @@ public void IssueTooLargeLzwBits<TPixel>(TestImageProvider<TPixel> provider)
         image.DebugSaveMultiFrame(provider);
         image.CompareToReferenceOutputMultiFrame(provider, ImageComparer.Exact);
     }
+
+    // https://github.com/SixLabors/ImageSharp/issues/2859
+    [Theory]
+    [WithFile(TestImages.Gif.Issues.Issue2859_A, PixelTypes.Rgba32)]
+    [WithFile(TestImages.Gif.Issues.Issue2859_B, PixelTypes.Rgba32)]
+    public void Issue2859_LZWPixelStackOverflow<TPixel>(TestImageProvider<TPixel> provider)
+        where TPixel : unmanaged, IPixel<TPixel>
+    {
+        using Image<TPixel> image = provider.GetImage();
+        image.DebugSaveMultiFrame(provider);
+        image.CompareToReferenceOutputMultiFrame(provider, ImageComparer.Exact);
+    }
 }

tests/ImageSharp.Tests/TestImages.cs

@@ -535,6 +535,8 @@ public static class Issues
             public const string Issue2450_B = "Gif/issues/issue_2450_2.gif";
             public const string Issue2198 = "Gif/issues/issue_2198.gif";
             public const string Issue2758 = "Gif/issues/issue_2758.gif";
+            public const string Issue2859_A = "Gif/issues/issue_2859_A.gif";
+            public const string Issue2859_B = "Gif/issues/issue_2859_B.gif";
         }
 
         public static readonly string[] Animated =