Backport V2 - GIF: Check for end of stream when reading comments.

Directory.Build.props

@@ -33,4 +33,13 @@
   <PropertyGroup Condition="$(Configuration.StartsWith('Release')) == true">
     <Optimize>true</Optimize>
   </PropertyGroup>
+
+  <!-- Required restore feeds. -->
+  <PropertyGroup>
+    <RestoreSources>
+      https://api.nuget.org/v3/index.json;
+      https://f.feedz.io/sixlabors/sixlabors/nuget/index.json;
+      https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-eng/nuget/v3/index.json;
+    </RestoreSources>
+  </PropertyGroup>
 </Project>

src/ImageSharp/Formats/Gif/GifDecoderCore.cs

@@ -191,7 +191,7 @@
         public IImageInfo Identify(BufferedReadStream stream, CancellationToken cancellationToken)
         {
             uint frameCount = 0;
             ImageFrameMetadata? previousFrame = null;
             List<ImageFrameMetadata> framesMetadata = new();
             try
             {
@@ -402,6 +402,11 @@
                     GifThrowHelper.ThrowInvalidImageContentException($"Gif comment length '{length}' exceeds max '{GifConstants.MaxCommentSubBlockLength}' of a comment data block");
                 }
 
+                if (length == -1)
+                {
+                    GifThrowHelper.ThrowInvalidImageContentException("Unexpected end of stream while reading gif comment");
+                }
+
                 if (this.skipMetadata)
                 {
                     stream.Seek(length, SeekOrigin.Current);
@@ -429,7 +434,7 @@
         /// <param name="stream">The <see cref="BufferedReadStream"/> containing image data.</param>
         /// <param name="image">The image to decode the information to.</param>
         /// <param name="previousFrame">The previous frame.</param>
         private void ReadFrame<TPixel>(BufferedReadStream stream, ref Image<TPixel>? image, ref ImageFrame<TPixel>? previousFrame)
             where TPixel : unmanaged, IPixel<TPixel>
         {
             this.ReadImageDescriptor(stream);
@@ -473,8 +478,8 @@
         /// <param name="descriptor">The <see cref="GifImageDescriptor"/></param>
         private void ReadFrameColors<TPixel>(
             BufferedReadStream stream,
             ref Image<TPixel>? image,
             ref ImageFrame<TPixel>? previousFrame,
             ReadOnlySpan<Rgb24> colorTable,
             in GifImageDescriptor descriptor)
             where TPixel : unmanaged, IPixel<TPixel>
@@ -483,8 +488,8 @@
             int imageHeight = this.logicalScreenDescriptor.Height;
             bool transFlag = this.graphicsControlExtension.TransparencyFlag;
 
             ImageFrame<TPixel>? prevFrame = null;
             ImageFrame<TPixel>? currentFrame = null;
             ImageFrame<TPixel> imageFrame;
 
             if (previousFrame is null)
@@ -638,7 +643,7 @@
         /// <param name="stream">The <see cref="BufferedReadStream"/> containing image data.</param>
         /// <param name="frameMetadata">The collection of frame metadata.</param>
         /// <param name="previousFrame">The previous frame metadata.</param>
         private void ReadFrameMetadata(BufferedReadStream stream, List<ImageFrameMetadata> frameMetadata, ref ImageFrameMetadata? previousFrame)
         {
             this.ReadImageDescriptor(stream);
 
@@ -772,7 +777,7 @@
                     Span<byte> globalColorTableSpan = this.globalColorTable.GetSpan();
                     stream.Read(globalColorTableSpan);
 
                     //Color[] colorTable = new Color[this.logicalScreenDescriptor.GlobalColorTableSize];
                     //ReadOnlySpan<Rgb24> rgbTable = MemoryMarshal.Cast<byte, Rgb24>(globalColorTableSpan);
                     //for (int i = 0; i < colorTable.Length; i++)
                     //{

tests/ImageSharp.Tests/Formats/Gif/GifDecoderTests.cs

@@ -183,16 +183,16 @@ public void Issue1530_BadDescriptorDimensions<TPixel>(TestImageProvider<TPixel>
             image.CompareToReferenceOutputMultiFrame(provider, ImageComparer.Exact);
         }
 
-    // https://github.com/SixLabors/ImageSharp/issues/2758
-    [Theory]
-    [WithFile(TestImages.Gif.Issues.Issue2758, PixelTypes.Rgba32)]
-    public void Issue2758_BadDescriptorDimensions<TPixel>(TestImageProvider<TPixel> provider)
-        where TPixel : unmanaged, IPixel<TPixel>
-    {
-        using Image<TPixel> image = provider.GetImage();
-        image.DebugSaveMultiFrame(provider);
-        image.CompareToReferenceOutputMultiFrame(provider, ImageComparer.Exact);
-    }
+        // https://github.com/SixLabors/ImageSharp/issues/2758
+        [Theory]
+        [WithFile(TestImages.Gif.Issues.Issue2758, PixelTypes.Rgba32)]
+        public void Issue2758_BadDescriptorDimensions<TPixel>(TestImageProvider<TPixel> provider)
+            where TPixel : unmanaged, IPixel<TPixel>
+        {
+            using Image<TPixel> image = provider.GetImage();
+            image.DebugSaveMultiFrame(provider);
+            image.CompareToReferenceOutputMultiFrame(provider, ImageComparer.Exact);
+        }
 
         // https://github.com/SixLabors/ImageSharp/issues/405
         [Theory]
@@ -329,5 +329,18 @@ public void Issue2859_LZWPixelStackOverflow<TPixel>(TestImageProvider<TPixel> pr
             image.DebugSaveMultiFrame(provider);
             image.CompareToReferenceOutputMultiFrame(provider, ImageComparer.Exact);
         }
+
+        // https://github.com/SixLabors/ImageSharp/issues/2953
+        [Theory]
+        [WithFile(TestImages.Gif.Issues.Issue2953, PixelTypes.Rgba32)]
+        public void Issue2953<TPixel>(TestImageProvider<TPixel> provider)
+            where TPixel : unmanaged, IPixel<TPixel>
+        {
+            // We should throw a InvalidImageContentException when trying to identify or load an invalid GIF file.
+            var testFile = TestFile.Create(provider.SourceFileOrDescription);
+
+            Assert.Throws<InvalidImageContentException>(() => Image.Identify(testFile.FullPath));
+            Assert.Throws<InvalidImageContentException>(() => Image.Load(testFile.FullPath));
+        }
     }
 }

tests/ImageSharp.Tests/TestImages.cs

@@ -468,6 +468,7 @@ public static class Issues
                 public const string Issue2758 = "Gif/issues/issue_2758.gif";
                 public const string Issue2859_A = "Gif/issues/issue_2859_A.gif";
                 public const string Issue2859_B = "Gif/issues/issue_2859_B.gif";
+                public const string Issue2953 = "Gif/issues/issue_2953.gif";
             }
 
             public static readonly string[] All = { Rings, Giphy, Cheers, Trans, Kumin, Leo, Ratio4x1, Ratio1x4 };